Windows Animated Cursor Handling Exploit (0day) (Version3)

vendor:

Windows Vista

by:

jamikazu

7.5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Windows Vista

Affected Version From: Windows Vista

Affected Version To: Windows Vista

Patch Exists: NO

Related CWE: CVE-2007-0038

CPE: o:microsoft:windows_vista

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2008-0038/

Other Scripts:

Platforms Tested: Windows Vista, Windows XP SP2

2007

Windows Animated Cursor Handling Exploit (0day) (Version3)

This exploit targets the Windows Animated Cursor Handling vulnerability in fully patched Windows Vista. It allows for remote code execution and is considered the first real exploit of its kind on Vista. The exploit has been tested on various Windows versions, including Windows Vista Enterprise Version 6.0 (Build 6000) and Windows Vista Ultimate Version 6.0 (Build 6000) with default installations and UAC enabled. It may also work on other NT-based Windows versions, although further testing is needed. The exploit bypasses the eeye security ani patch.

Mitigation:

Apply the latest security patches and updates from Microsoft. Disable the Windows Animated Cursor feature if not required.

Source

Exploit-DB raw data:

..::[ jamikazu presents ]::..

Windows Animated Cursor Handling Exploit (0day) (Version3)

Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)

Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2 
(It also must to work on all nt based windows but not tested)

Update: It also bypass eeye security ani patch!

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by determina (http://www.determina.com)

Credit: milw0rm,metasploit, SkyLined, http://doctus.net/

invokes calc.exe if successful 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3636.zip (04012007-exp.zip)

# milw0rm.com [2007-04-01]