Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting MS15-076 (CVE-2015-2370)

netspi.com | vulnerability | CVE-2015-2370 | #privilege-escalation | #windows | #ntlm-reflection | #symlink | #cve-2015-2370 | #ms15-076

Summary

Weaponizes CVE-2015-2370 NTLM reflection in DCOM/RPC by combining James Forshaw's PoC with junction and symlink tricks, turning a limited file write into arbitrary privileged file placement.
CVE
CVE-2015-2370
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege
A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.
blog · projectzero.google
Windows Exploitation Tricks: Arbitrary Directory Creation to Arbitrary File Read
A Project Zero post in the Windows exploitation tricks series, showing how an arbitrary directory creation primitive can be escalated into arbitrary file read.
blog · projectzero.google
Chrome OS exploit: one byte overflow and symlinks
A guest post detailing a Chrome OS exploit that combines a one-byte overflow with symlink tricks to escalate privileges, written by an external researcher.
blog · projectzero.google
Exploiting a Leaked Thread Handle
A bug in the Windows Secondary Logon service, fixed as MS16-032, leaks a fully accessible thread handle from a privileged process, enabling privilege escalation without memory corruption.
blog · projectzero.google
Raising the Dead
A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.
blog · projectzero.google
Windows Sandbox Attack Surface Analysis
Analyzing the attack surface of user-mode sandboxed applications helps find elevation of privilege bugs; automating the enumeration matters for initial analysis and detecting regressions.
back