The Microsoft Windows XRM-MS file type, associated with software licensing, allows adversaries to inject XML stylesheets pointing to LAN network shares or attacker-controlled infrastructure. This leads to outbound connections leaking the target's NTLM hash. The exploit works through LAN network shares or remote drive-by downloads, requiring user interaction to open the file. The xrm-ms file type bypasses some security measures and appears trust-worthy as it defaults to opening in Internet Explorer or Edge on Windows systems.
This exploit is for Windows 7 IIS7.5 FTPSVC. It allows an unauthenticated attacker to cause a denial of service (DOS) by sending a specially crafted payload to the FTP server.
The win32k.sys module in Microsoft Windows 7 does not perform proper bounds checks on HBITMAP handles, which allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, aka a 'Windows Kernel Elevation of Privilege Vulnerability'.
A crash due to an invalid read in the Windows kernel can be reliably leveraged into privileged code execution resulting in a privilege escalation local vulnerability. This happens because special values of 'hParent' where not sufficiently taken into account when patching 'xxxCreateWindowsEx' on MS010-032.
This is a proof of concept for MS10-054 vulnerability. It is a remote code execution vulnerability in Microsoft Windows SMB Client. An attacker could exploit this vulnerability by convincing a user to connect to a malicious SMB server or by tricking a user into clicking on a specially crafted link. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user.
PowerShell implementation of MS16-032. The exploit targets all vulnerable operating systems that support PowerShell v2+. Credit for the discovery of the bug and the logic to exploit it go to James Forshaw (@tiraniddo).
This exploit attempts to trigger the ICMP refCount overflow in the TCP/IP stack of Windows 7, Vista, and Windows Server 2008 hosts. It requires sending 2^32 UDP packets to a host on a closed port, or 4,294,967,296 packets. The exploit creates 250 threads and floods a host with UDP packets, then attempts to trigger the de-ref using ping. It is estimated that it would take approximately 52 days for the host to enter a condition where this vulnerability is triggerable.
The nt!NtGdiGetPhysicalMonitorDescription system call in Windows 7 to Windows 10 discloses uninitialized kernel stack memory to user-mode clients. The syscall copies a stack-based array of 256 bytes to the caller, but typically only a small portion of the buffer is used to store the requested monitor description, leaving the rest uninitialized. This uninitialized memory region contains sensitive information such as addresses of executable images, kernel stack, kernel pools, and stack cookies.
The win32k!NtGdiExtGetObjectW system call in Windows 7-10 allows disclosing portions of uninitialized kernel stack memory to user-mode applications. This is possible due to leftover kernel stack data in the trailing, uninitialized bytes of the LOGFONT structure for some stock fonts, which can be read back using the GetObject() function.
The generic exception dispatching code present in the Windows kernel discloses portions of uninitialized kernel stack memory to user-mode clients via the CONTEXT structure set up for the ring-3 exception handlers.
Services By CQR