windows
windows 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft MsMpEng – Remote Use-After-Free Due to Design Issue in GC Engine
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258
TiEmu 2.08 – Local Buffer Overflow
#!/usr/bin/python
Microsoft MsMpEng – Multiple Crashes While Scanning Malformed Files
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1261
Home Web Server 1.9.1 (build 164) – Remote Code Execution
# Exploit Title: Home Web Server 1.9.1 build 164 - CGI Remote Code Execution
Microsoft MsMpEng – Multiple Problems Handling ntdll!NtControlChannel Commands
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260
Sandboxie 5.18 – Local Denial of Service
author = '''
Secure Auditor 3.0 – Directory Traversal
[+] Credits: John Page aka HYP3RLINX
Sure Thing Disc Labeler 6.2.138.0 – Buffer Overflow (PoC)
# Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow (PoC)
Microsoft Windows – Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1112
Microsoft Windows – COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107
LabF nfsAxe 3.7 FTP Client – Remote Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Windows 7 Kernel – Pool-Based Out-of-Bounds Reads Due to bind() Implementation Bugs in afd.sys / tcpip.sys
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1127
Microsoft Windows 7 Kernel – ‘win32k!xxxClientLpkDrawTextEx’ Stack Memory Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1182
Microsoft Windows 10 Kernel – ‘nt!NtTraceControl (EtwpSetProviderTraits)’ Pool Memory Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1161
Microsoft Windows 7 Kernel – Uninitialized Memory in the Default dacl Descriptor of System Processes Token
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1145
Larson VizEx Reader 9.7.5 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Halliburton LogView Pro 10.0.1 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Dive Assistant Template Builder 8.0 – XML External Entity Injection
[+] Exploit Title: Dive Assistant - Template Builder XXE Injection
Microsoft Security Essentials / SCEP (Microsoft Windows 8/8.1/10 / Windows Server) – ‘MsMpEng’ Remote Type Confusion
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
Gemalto SmartDiag Diagnosis Tool < 2.5 - Local Buffer Overflow (SEH)
# Exploit Title: Gemalto SmartDiag Diagnosis Tool
MediaCoder 0.8.48.5888 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Serviio PRO 1.8 DLNA Media Streaming Server – REST API Arbitrary Code Execution
#!/usr/bin/env python
Serviio PRO 1.8 DLNA Media Streaming Server – Local Privilege Escalation
Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation
Microsoft Internet Explorer 11 – ‘CMarkup::DestroySplayTree’ Use-After-Free
IE11 MSHTML!CMarkup::DestroySplayTree Use-After-Free
IrfanView 4.44 – Denial of Service
# Exploit Title: Irfanview - OtherExtensions Input Overflow
Panda Free Antivirus – ‘PSKMAD.sys’ Denial of Service
# Exploit Title: Panda Cloud Antivirus Free - 'PSKMAD.sys' - BSoD - denial of service
Realtek Audio Driver 6.0.1.7898 (Windows 10) – Dolby Audio X2 Service Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075
Microsoft Windows 2003 SP2 – ‘ERRATICGOPHER’ SMB Remote Code Execution
#!/usr/bin/env python
Dell Customer Connect 1.3.28.0 – Local Privilege Escalation
# Exploit Dell Customer Connect 1.3.28.0 Privilege Escalation
PrivateTunnel Client 2.8 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Windows – ManagementObject Arbitrary .NET Serialization Remote Code Execution
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081
Microsoft Windows 10 – Runtime Broker ClipboardBroker Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1079
Microsoft Windows 10 (Build 10586) – ‘IEETWCollector’ Arbitrary Directory/File Deletion Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1093
Microsoft Word – ‘.RTF’ Remote Code Execution
#!/usr/bin/env python
VirusChaser 8.0 – Local Buffer Overflow (SEH)
# Exploit Title: Virus Chaser 8.0 - Scanner component, SEH Overflow
Microsoft Windows Kernel – ‘win32kfull!SfnINLPUAHDRAWMENUITEM’ Stack Memory Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1192
Microsoft Windows Kernel – ‘win32k.sys’ Multiple ‘NtGdiGetDIBitsInternal’ System Call
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1078
Adobe Creative Cloud Desktop Application < 4.0.0.185 - Local Privilege Escalation
[+] Credits: John Page aka hyp3rlinx