Metasploit modules that can be used to exploit Microsoft » Windows Server 2008 » r2 sp1

Order by Disclosure Date Module Name Module Type
  • Microsoft Office Word MSDTJS
    Disclosure Date: 2022-05-29
    First seen: 2022-12-23
    exploit/windows/fileformat/word_msdtjs_rce
    This module generates a malicious Microsoft Word document that when loaded, will leverage the remote template feature to fetch an `HTML` document and then use the `ms-msdt` scheme to execute `PowerShell` code.
  • Windows NtUserSetWindowFNID Win32k User Callback
    Disclosure Date: 2018-10-09
    First seen: 2020-04-26
    exploit/windows/local/cve_2018_8453_win32k_priv_esc
    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This module is tested against Windows 10 v1703 x86. Authors: - ze0r - Kaspersky Lab - Jacob Robles
  • Microsoft Windows ALPC Task Scheduler Local Privilege Elevation
    Disclosure Date: 2018-08-27
    First seen: 2020-04-26
    exploit/windows/local/alpc_taskscheduler
    On vulnerable versions of Windows the alpc endpoint method SchRpcSetSecurity implemented by the task scheduler service can be used to write arbitrary DACLs to `.job` files located in `c:\windows\tasks` because the scheduler does not use impersonation when checking this location. Since users can create files in the `c:\windows\tasks` folder, a hardlink can be created to a file the user has read access to. After creating a hardlink, the vulnerability can be triggered to set the DACL on the linked file. WARNING: The PrintConfig.dll (%windir%\system32\driverstor\filerepository\prnms003*) on the target host will be overwritten when the exploit runs. This module has been tested against Windows 10 Pro x64. Authors: - SandboxEscaper - bwatters-r7 - asoto-r7 - Jacob Robles
  • Microsoft Office Word Malicious Hta Execution
    Disclosure Date: 2017-04-14
    First seen: 2020-04-26
    exploit/windows/fileformat/office_word_hta
    This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how a olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample. Authors: - Haifei Li - ryHanson - wdormann - DidierStevens - vysec - Nixawk - sinn3r <sinn3r@metasploit.com>
  • NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)
    Disclosure Date: 2016-06-14
    First seen: 2020-04-26
    auxiliary/server/netbios_spoof_nat
    This module listens for a NetBIOS name request and then continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed networks, the PPSRATE value should be increased to speed up this attack. As an example, a value of around 30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup. Distant targets may require more time and lower rates for a successful attack. This module works when the target is behind a NAT gateway, since the stream of NetBIOS responses will keep the NAT mapping alive after the initial setup. To trigger the initial NetBIOS request to the Metasploit system, force the target to access a UNC link pointing to the same address (HTML, Office attachment, etc). This NAT-piercing issue was named the 'BadTunnel' vulnerability by the discoverer, Yu Yang (@tombkeeper). The Microsoft patches (MS16-063/MS16-077) impact the way that the proxy host (WPAD) host is identified, but do change the predictability of NetBIOS requests. Authors: - vvalien - hdm <x@hdm.io> - tombkeeper
  • NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)
    Disclosure Date: 2016-06-14
    First seen: 2020-04-26
    auxiliary/server/netbios_spoof_nat
    This module listens for a NetBIOS name request and then continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed networks, the PPSRATE value should be increased to speed up this attack. As an example, a value of around 30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup. Distant targets may require more time and lower rates for a successful attack. This module works when the target is behind a NAT gateway, since the stream of NetBIOS responses will keep the NAT mapping alive after the initial setup. To trigger the initial NetBIOS request to the Metasploit system, force the target to access a UNC link pointing to the same address (HTML, Office attachment, etc). This NAT-piercing issue was named the 'BadTunnel' vulnerability by the discoverer, Yu Yang (@tombkeeper). The Microsoft patches (MS16-063/MS16-077) impact the way that the proxy host (WPAD) host is identified, but do change the predictability of NetBIOS requests. Authors: - vvalien - hdm <x@hdm.io> - tombkeeper
  • MS16-032 Secondary Logon Handle Privilege Escalation
    Disclosure Date: 2016-03-21
    First seen: 2020-04-26
    exploit/windows/local/ms16_032_secondary_logon_handle_privesc
    This module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores. Authors: - James Forshaw - b33f - khr0x40sh
  • MS16-016 mrxdav.sys WebDav Local Privilege Escalation
    Disclosure Date: 2016-02-09
    First seen: 2020-04-26
    exploit/windows/local/ms16_016_webdav
    This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate its privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process. Authors: - Tamas Koczka - William Webb <william_webb@rapid7.com>
  • Windows Net-NTLMv2 Reflection DCOM/RPC
    Disclosure Date: 2016-01-16
    First seen: 2020-04-26
    exploit/windows/local/ms16_075_reflection
    Module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. Currently the module does not spawn as SYSTEM, however once achieving a shell, one can easily use incognito to impersonate the token. Authors: - FoxGloveSec - breenmachine - Mumbai
  • Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)
    Disclosure Date: 2016-01-16
    First seen: 2020-04-26
    exploit/windows/local/ms16_075_reflection_juicy
    This module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. It requires a CLSID string. Windows 10 after version 1803, (April 2018 update, build 17134) and all versions of Windows Server 2019 are not vulnerable. Authors: - FoxGloveSec - breenmachine - decoder - ohpe - phra - lupman
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Windows WMI Receive Notification Exploit
    Disclosure Date: 2015-12-04
    First seen: 2020-04-26
    exploit/windows/local/ms16_014_wmi_recv_notif
    This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. Authors: - smmrootkit - de7ec7ed - de7ec7ed
  • MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape
    Disclosure Date: 2015-01-13
    First seen: 2020-04-26
    exploit/windows/local/ms15_004_tswbproxy
    This module abuses a process creation policy in Internet Explorer's sandbox; specifically, Microsoft's RemoteApp and Desktop Connections runtime proxy, TSWbPrxy.exe. This vulnerability allows the attacker to escape the Protected Mode and execute code with Medium Integrity. At the moment, this module only bypass Protected Mode on Windows 7 SP1 and prior (32 bits). This module has been tested successfully on Windows 7 SP1 (32 bits) with IE 8 and IE 11. Authors: - Unknown - Henry Li - juan vazquez <juan.vazquez@metasploit.com>
  • MS14-068 Microsoft Kerberos Checksum Validation Vulnerability
    Disclosure Date: 2014-11-18
    First seen: 2020-04-26
    auxiliary/admin/kerberos/ms14_068_kerberos_checksum
    This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS request, where a domain user may forge a PAC with arbitrary privileges, including Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz help. It has been tested successfully on Windows 2008. Authors: - Tom Maddock - Sylvain Monne - juan vazquez <juan.vazquez@metasploit.com>
  • MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python
    Disclosure Date: 2014-11-12
    First seen: 2020-04-26
    exploit/windows/fileformat/ms14_064_packager_python
    This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, bypassing the patch MS14-060, for the vulnerability publicly known as "Sandworm", on systems with Python for Windows installed. Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. Please keep in mind that some other setups such as those using Office 2010 SP1 may be less stable, and may end up with a crash due to a failure in the CPackage::CreateTempFileName function. Authors: - Haifei Li - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • MS14-064 Microsoft Windows OLE Package Manager Code Execution
    Disclosure Date: 2014-10-21
    First seen: 2020-04-26
    exploit/windows/fileformat/ms14_064_packager_run_as_admin
    This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, publicly exploited in the wild as MS14-060 patch bypass. The Microsoft update tried to fix the vulnerability publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. Please keep in mind that some other setups such as using Office 2010 SP1 might be less stable, and may end up with a crash due to a failure in the CPackage::CreateTempFileName function. Authors: - Haifei Li - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • MS14-060 Microsoft Windows OLE Package Manager Code Execution
    Disclosure Date: 2014-10-14
    First seen: 2020-04-26
    exploit/windows/fileformat/ms14_060_sandworm
    This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. And please keep in mind that some other setups such as using Office 2010 SP1 might be less stable, and sometimes may end up with a crash due to a failure in the CPackage::CreateTempFileName function. This module will generate three files: an INF, a GIF, and a PPSX file. You are required to set up a SMB or Samba 3 server and host the INF and GIF there. Systems such as Ubuntu or an older version of Windows (such as XP) work best for this because they require little configuration to get going. The PPSX file is what you should send to your target. In detail, the vulnerability has to do with how the Object Packager 2 component (packager.dll) handles an INF file that contains malicious registry changes, which may be leveraged for code execution. First of all, Packager does not load the INF file directly. As an attacker, you can trick it to load your INF anyway by embedding the file path as a remote share in an OLE object. The packager will then treat it as a type of media file, and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will download it with a CopyFileW call, save it in a temp folder, and pass that information for later. The exploit will do this loading process twice: first for a fake gif file that's actually the payload, and the second for the INF file. The packager will also look at each OLE object's XML Presentation Command, specifically the type and cmd property. In the exploit, "verb" media command type is used, and this triggers the packager!CPackage::DoVerb function. Also, "-3" is used as the fake gif file's cmd property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3" is used (again, for the INF file), it will cause the packager to try to find appropriate handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that will install/run the malicious INF file, and finally give us arbitrary code execution. Authors: - Unknown - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Windows TrackPopupMenu Win32k NULL Pointer Dereference
    Disclosure Date: 2014-10-14
    First seen: 2020-04-26
    exploit/windows/local/ms14_058_track_popup_menu
    This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability can be triggered through the use of TrackPopupMenu. Under special conditions, the NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary code execution. This module has been tested successfully on Windows XP SP3, Windows 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows 2008 R2 SP1 64 bits. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com> - Spencer McIntyre - OJ Reeves <oj@buffered.io>
  • MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check
    Disclosure Date: 2014-09-30
    First seen: 2020-04-26
    exploit/windows/local/ntapphelpcachecontrol
    On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext. This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check. This module currently only affects Windows 8 and Windows 8.1, and requires access to C:\Windows\System\ComputerDefaults.exe (although this can be improved). Authors: - James Forshaw - sinn3r <sinn3r@metasploit.com>
22 metasploit modules found
1 2
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close