Metasploit modules that can be used to exploit Microsoft » Windows Server 2019 » N/A

Order by Disclosure Date Module Name Module Type
  • Microsoft Error Reporting Local Privilege Elevation Vulnerability
    Disclosure Date: 2023-07-11
    First seen: 2023-10-08
    exploit/windows/local/win_error_cve_2023_36874
    This module takes advantage of a bug in the way Windows error reporting opens the report parser. If you open a report, Windows uses a relative path to locate the rendering program. By creating a specific alternate directory structure, we can coerce Windows into opening an arbitrary executable as SYSTEM. If the current user is a local admin, the system will attempt impersonation and the exploit will fail.
  • Windows Common Log File System Driver (clfs.sys) Elevation of Privilege Vulnerability
    Disclosure Date: 2023-04-11
    First seen: 2023-10-08
    exploit/windows/local/cve_2023_28252_clfs_driver
    A privilege escalation vulnerability exists in the clfs.sys driver which comes installed by default on Windows 10 21H2, Windows 11 21H2 and Windows Server 20348 operating systems. The clfs.sys driver contains a function CreateLogFile that is used to create open and edit '*.blf' (base log format) files. Inside a .blf file there are multiple blocks of data which contain checksums to verify the integrity of the .blf file and to ensure the file looks and acts like a .blf file. However, these files can be edited with CreateFileA or with fopen and then modified with WriteFile or fwrite respectively in order to change the contents of the file and update their checksums accordingly. This exploit makes use to two different kinds of specially crafted .blf files that are edited using the technique mentioned above. There are multiple spray .blf files. The spray .blf files are specially crafted to initiate an out of bounds read which reads from a contiguous block of memory. The block of memory it reads from contains a read-write pipe that points to the address of the second type of .blf file - the trigger .blf file. The trigger .blf file is specially crafted read the SYSTEM token and write it in the process of the exploit to achieve the local privilege escalation. The exploits creates a controlled memory space by first looping over the CreatePipe function to to create thousands of read-write pipes (which take up 0x90 bytes of memory). It then releases a certain number of pipes from memory and calls CreateLogFile to open the pre-existing spray .blf files which when being opened fill the 0x90 byte gaps created by the deallocation of the pipes in memory, creating the controlled memory space. This is a very brief and high overview description of what the exploit is actually doing. For a more detailed and in depth analysis please refer to the following [reference](https://github.com/fortra/CVE-2023-28252). Authors: - Ricardo Narvaja - Esteban.kazimirow - jheysel-r7
  • CVE-2023-21554 - QueueJumper - MSMQ RCE Check
    Disclosure Date: 2023-04-11
    First seen: 2023-09-11
    auxiliary/scanner/msmq/cve_2023_21554_queuejumper
    This module checks the provided hosts for the CVE-2023-21554 vulnerability by sending a MSMQ message with an altered DataLength field within the SRMPEnvelopeHeader that overflows the given buffer. On patched systems, the error is caught and no response is sent back. On vulnerable systems, the integer wraps around and depending on the length could cause an out-of-bounds write. In the context of this module a response is sent back, which indicates that the system is vulnerable. Authors: - Wayne Low - Haifei Li - Bastian Kanbach <bastian.kanbach@securesystems.de>
  • Microsoft Office Word MSDTJS
    Disclosure Date: 2022-05-29
    First seen: 2022-12-23
    exploit/windows/fileformat/word_msdtjs_rce
    This module generates a malicious Microsoft Word document that when loaded, will leverage the remote template feature to fetch an `HTML` document and then use the `ms-msdt` scheme to execute `PowerShell` code.
  • User Profile Arbitrary Junction Creation Local Privilege Elevation
    Disclosure Date: 2022-03-17
    First seen: 2022-12-23
    exploit/windows/local/cve_2022_26904_superprofile
    The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability in its CreateDirectoryJunction() function due to a lack of appropriate checks on the directory structure of the junctions it tries to link together. Attackers can leverage this vulnerability to plant a malicious DLL in a system directory and then trigger a UAC prompt to cause this DLL to be loaded and executed by ProfSrv as the NT AUTHORITY\SYSTEM user. Note that this bug was originally identified as CVE-2021-34484 and was subsequently patched a second time as CVE-2022-21919, however both patches were found to be insufficient. This bug is a patch bypass for CVE-2022-21919 and at the time of publishing, has not yet been patched, though plans are in place to patch it as CVE-2022-26904. It is important to note that the credentials supplied for the second user to log in as in this exploit must be those of a normal non-admin user and these credentials must also corralate with a user who has already logged in at least once before. Additionally the current user running the exploit must have UAC set to the highest level, aka "Always Notify Me When", in order for the code to be executed as NT AUTHORITY\SYSTEM. Note however that "Always Notify Me When" is the default UAC setting on common Windows installs, so this would only affect instances where this setting has been changed either manually or as part of the installation process. Authors: - KLINIX5 - Grant Willcox
  • CVE-2022-21999 SpoolFool Privesc
    Disclosure Date: 2022-02-08
    First seen: 2022-12-23
    exploit/windows/local/cve_2022_21999_spoolfool_privesc
    The Windows Print Spooler has a privilege escalation vulnerability that can be leveraged to achieve code execution as SYSTEM. The `SpoolDirectory`, a configuration setting that holds the path that a printer's spooled jobs are sent to, is writable for all users, and it can be configured via `SetPrinterDataEx()` provided the caller has the `PRINTER_ACCESS_ADMINISTER` permission. If the `SpoolDirectory` path does not exist, it will be created once the print spooler reinitializes. Calling `SetPrinterDataEx()` with the `CopyFiles\` registry key will load the dll passed in as the `pData` argument, meaning that writing a dll to the `SpoolDirectory` location can be loaded by the print spooler. Using a directory junction and UNC path for the `SpoolDirectory`, the exploit writes a payload to `C:\Windows\System32\spool\drivers\x64\4` and loads it by calling `SetPrinterDataEx()`, resulting in code execution as SYSTEM. Authors: - Oliver Lyak - Shelby Pace
  • Win32k NtGdiResetDC Use After Free Local Privilege Elevation
    Disclosure Date: 2021-10-12
    First seen: 2022-12-23
    exploit/windows/local/cve_2021_40449
    A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by an attacker to escalate privileges to those of `NT AUTHORITY\SYSTEM`. The flaw exists due to the fact that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\SYSTEM. This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions of Windows 10 will likely also work. Authors: - IronHusky - Costin Raiu - Boris Larin - Red Raindrop Team of Qi'anxin Threat Intelligence Center - KaLendsi - ly4k - Grant Willcox
  • Microsoft Office Word Malicious MSHTML RCE
    Disclosure Date: 2021-09-23
    First seen: 2022-12-23
    exploit/windows/fileformat/word_mshtml_rce
    This module creates a malicious docx file that when opened in Word on a vulnerable Windows system will lead to code execution. This vulnerability exists because an attacker can craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine.
  • Print Spooler Remote DLL Injection
    Disclosure Date: 2021-06-08
    First seen: 2022-12-23
    exploit/windows/dcerpc/cve_2021_1675_printnightmare
    The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Authors: - Zhiniang Peng - Xuefeng Li - Zhipeng Huo - Piotr Madej - Zhang Yunhai - cube0x0 - Spencer McIntyre - Christophe De La Fuente
  • Print Spooler Remote DLL Injection
    Disclosure Date: 2021-06-08
    First seen: 2022-12-23
    exploit/windows/dcerpc/cve_2021_1675_printnightmare
    The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Authors: - Zhiniang Peng - Xuefeng Li - Zhipeng Huo - Piotr Madej - Zhang Yunhai - cube0x0 - Spencer McIntyre - Christophe De La Fuente
  • Win32k ConsoleControl Offset Confusion
    Disclosure Date: 2021-02-09
    First seen: 2022-12-23
    exploit/windows/local/cve_2022_21882_win32k
    A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to achieve an out of bounds write operation, eventually leading to privilege escalation. This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021. In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to function on a wider range of Windows 10 targets. Authors: - BITTER APT - JinQuan - MaDongZe - TuXiaoYi - LiHao - L4ys - KaLendsi - Spencer McIntyre
  • Win32k ConsoleControl Offset Confusion
    Disclosure Date: 2021-02-09
    First seen: 2022-12-23
    exploit/windows/local/cve_2022_21882_win32k
    A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to achieve an out of bounds write operation, eventually leading to privilege escalation. This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021. In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to function on a wider range of Windows 10 targets. Authors: - BITTER APT - JinQuan - MaDongZe - TuXiaoYi - LiHao - L4ys - KaLendsi - Spencer McIntyre
  • CVE-2020-1170 Cloud Filter Arbitrary File Creation EOP
    Disclosure Date: 2020-03-10
    First seen: 2021-01-12
    exploit/windows/local/cve_2020_17136
    The Cloud Filter driver, cldflt.sys, on Windows 10 v1803 and later, prior to the December 2020 updates, did not set the IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCESS_CHECK flags when calling FltCreateFileEx() and FltCreateFileEx2() within its HsmpOpCreatePlaceholders() function with attacker controlled input. This meant that files were created with KernelMode permissions, thereby bypassing any security checks that would otherwise prevent a normal user from being able to create files in directories they don't have permissions to create files in. This module abuses this vulnerability to perform a DLL hijacking attack against the Microsoft Storage Spaces SMP service, which grants the attacker code execution as the NETWORK SERVICE user. Users are strongly encouraged to set the PAYLOAD option to one of the Meterpreter payloads, as doing so will allow them to subsequently escalate their new session from NETWORK SERVICE to SYSTEM by using Meterpreter's "getsystem" command to perform RPCSS Named Pipe Impersonation and impersonate the SYSTEM user. Authors: - James Foreshaw - Grant Willcox
  • Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability
    Disclosure Date: 2020-03-10
    First seen: 2020-06-11
    exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move
    This module exploits CVE-2020-0787, an arbitrary file move vulnerability in outdated versions of the Background Intelligent Transfer Service (BITS), to overwrite C:\Windows\System32\WindowsCoreDeviceInfo.dll with a malicious DLL containing the attacker's payload. To achieve code execution as the SYSTEM user, the Update Session Orchestrator service is then started, which will result in the malicious WindowsCoreDeviceInfo.dll being run with SYSTEM privileges due to a DLL hijacking issue within the Update Session Orchestrator Service. Note that presently this module only works on Windows 10 and Windows Server 2016 and later as the Update Session Orchestrator Service was only introduced in Windows 10. Note that only Windows 10 has been tested, so your mileage may vary on Windows Server 2016 and later. Authors: - itm4n - gwillcox-r7
  • Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation
    Disclosure Date: 2020-02-20
    First seen: 2020-12-15
    exploit/windows/local/cve_2020_1054_drawiconex_lpe
    This module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx within win32k. The out of bounds write can be used to overwrite the pvbits of a SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary code execution as the SYSTEM user. This module has been tested against a fully updated Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows. Authors: - Netanel Ben-Simon - Yoav Alon - bee13oy - timwr
  • Service Tracing Privilege Elevation Vulnerability
    Disclosure Date: 2020-02-11
    First seen: 2020-05-14
    exploit/windows/local/cve_2020_0668_service_tracing
    This module leverages a trusted file overwrite with a DLL hijacking vulnerability to gain SYSTEM-level access on vulnerable Windows 10 x64 targets. Authors: - itm4n - bwatters-r7
  • Microsoft UPnP Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-12
    First seen: 2020-04-26
    exploit/windows/local/comahawk
    This exploit uses two vulnerabilities to execute a command as an elevated user. The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM. Authors: - NCC Group - hoangprod - bwatters-r7
  • Microsoft UPnP Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-12
    First seen: 2020-04-26
    exploit/windows/local/comahawk
    This exploit uses two vulnerabilities to execute a command as an elevated user. The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM. Authors: - NCC Group - hoangprod - bwatters-r7
  • Microsoft Spooler Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-04
    First seen: 2021-01-16
    exploit/windows/local/cve_2020_1337_printerdemon
    This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor. Authors: - Peleg Hadar - Tomer Bar - 404death - sailay1996 - bwatters-r7
  • Microsoft Spooler Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-04
    First seen: 2020-09-17
    exploit/windows/local/cve_2020_1048_printerdemon
    This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor. Authors: - Yarden Shafir - Alex Ionescu - shubham0d - bwatters-r7
25 metasploit modules found
1 2
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close