Exploit-CVE-2017-6008

vendor:

HitmanPro

by:

Tarjei Mandt

7,8

CVSS

HIGH

Kernel Pool Buffer Overflow

119

CWE

Product Name: HitmanPro

Affected Version From: HitmanPro 3.7.9

Affected Version To: HitmanPro 3.7.9

Patch Exists: YES

Related CWE: CVE-2017-6008

CPE: a:surfright:hitmanpro

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7, Windows 10

2017

CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper. It also uses the Pool sprayer library. A detailed paper on the Windows 7 exploit is available at https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/. The Windows 10 version uses another vulnerability in the hitmanpro37.sys driver, an Out-Of-Bounds read, which is used to leak the Pool Cookie. This leak allows us to use the very same attack on Windows 10. A detailed paper of the exploit on Windows 10 is available at https://trackwatch.com/.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

Exploit-CVE-2017-6008

The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper

Also, the exploits use my Pool sprayer library

You can find a detailed paper on the Windows 7 exploit here: 
https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/

Windows 10 version

This version use another vulnerability in the hitmanpro37.sys driver, an Out-Of-Bounds read, which we use to leak the Pool Cookie. This leak allows us to use the very same attack on Windows 10.

You can find a detailed paper of the exploit on Windows 10 here (coming soon):
https://trackwatch.com/


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43057.zip