---
id: 8203
title: "Exploiting MS15-076 (CVE-2015-2370)"
cve: CVE-2015-2370
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/exploiting-ms15-076-cve-2015-2370/"
published_at: "2015-08-12T00:00:00Z"
tags: ["privilege-escalation", "windows", "ntlm-reflection", "symlink", "cve-2015-2370", "ms15-076"]
phying_url: "https://phying.com/item/8203"
lang: en
---

# Exploiting MS15-076 (CVE-2015-2370)

## Summary

Weaponizes CVE-2015-2370 NTLM reflection in DCOM/RPC by combining James Forshaw's PoC with junction and symlink tricks, turning a limited file write into arbitrary privileged file placement.

## Intelligence Metadata

- **Sources:** netspi.com
- **CVE:** CVE-2015-2370
- **Published:** 2015-08-12T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/exploiting-ms15-076-cve-2015-2370/
- **Phying News:** https://phying.com/item/8203