From 56c5eac8234056105474fbbfc630914736f60fdc Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 2 May 2014 14:18:18 +0100 Subject: [PATCH] Message correction --- modules/exploits/windows/local/ms13_053_schlamperei.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/ms13_053_schlamperei.rb b/modules/exploits/windows/local/ms13_053_schlamperei.rb index 93748a9c313a..48e9fa8da3f5 100644 --- a/modules/exploits/windows/local/ms13_053_schlamperei.rb +++ b/modules/exploits/windows/local/ms13_053_schlamperei.rb @@ -15,13 +15,13 @@ class Metasploit3 < Msf::Exploit::Local include Msf::Post::Windows::Process include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - + def initialize(info={}) super(update_info(info, { 'Name' => 'Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)', 'Description' => %q{ A kernel pool overflow in Win32k which allows local privilege escalation. - The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process). + The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process). This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox. NOTE: when you exit the meterpreter session, winlogon.exe is likely to crash.