PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-36802] Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

theori.io | vulnerability | CVE-2023-36802 | #privilege-escalation | #exploit-chain | #windows-kernel | #cve-2023-36802 | #mskssrv
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
CVE
CVE-2023-36802
Published
Collected

Related coverage

research · starlabs.sg
Old Bug, Harder Rules : Exploiting CVE-2023-36802 Without the Usual Shortcuts
Exploiting CVE-2023-36802, a type confusion in Microsoft's mskssrv.sys driver, without the usual shortcuts: no NtQuery* leaks or PreviousMode read/write, only what works under current mitigations.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System
Part three of the N-day exploit chain series, covering a Windows driver privilege-escalation flaw used to move from medium-integrity access to SYSTEM in a full exploit chain.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
vulnerability · theori.io
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)
How Theori found and reliably exploited CVE-2023-28218, a heap overflow in Windows' afd.sys Fast I/O path, turning wild copy with user fault handling into a kernel exploit, detailed at Hexacon 2023.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
Back