Skip to content

Commit 4911127

Browse files
committed
Match the title and change the description a little bit
1 parent f998bfc commit 4911127

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

modules/exploits/windows/local/ntapphelpcachecontrol.rb

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ class Metasploit3 < Msf::Exploit::Local
1616

1717
def initialize(info={})
1818
super(update_info(info, {
19-
'Name' => 'Windows NtApphelpCacheControl Token Impersonation',
19+
'Name' => 'Windows NtApphelpCacheControl Improper Authorization Check',
2020
'Description' => %q{
21-
On Windows 8, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)
21+
On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)
2222
allows application compatibility data to be cached for quick reuse when new processes are
2323
created. A normal user can query the cache but cannot add new cached entries as the
2424
operation is restricted to administrators. This is checked in the function
@@ -30,6 +30,9 @@ def initialize(info={})
3030
the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level
3131
of the token so it's possible to get an identify token on your thread from a local system
3232
process and bypass this check.
33+
34+
This module currently only affects Windows 8 and Windows 8.1, and requires access to
35+
C:\Windows\System\ComputerDefaults.exe (although this can be improved).
3336
},
3437
'License' => MSF_LICENSE,
3538
'Author' =>
@@ -46,7 +49,7 @@ def initialize(info={})
4649
},
4750
'Targets' =>
4851
[
49-
[ 'Windows 8', { } ]
52+
[ 'Windows 8 / 8.1', { } ]
5053
],
5154
'Payload' =>
5255
{

0 commit comments

Comments
 (0)