Skip to content

Commit 5ea6758

Browse files
author
Tod Beardsley
committed
Rewrite description for MS13-005
The first part of the description was copy-pasted from http://packetstormsecurity.com/files/122588/ms13_005_hwnd_broadcast.rb.txt which contained some grammatical errors. Please try to avoid cribbing other researchers' descriptions directly for Metasploit modules.
1 parent e7206af commit 5ea6758

File tree

1 file changed

+13
-15
lines changed

1 file changed

+13
-15
lines changed

modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,21 +22,19 @@ def initialize(info={})
2222
super( update_info( info,
2323
'Name' => 'MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation',
2424
'Description' => %q{
25-
The Windows kernel does not properly isolate broadcast messages from low integrity
26-
applications from medium or high integrity applications. This allows commands to be
27-
broadcasted to an open medium or high integrity command prompts allowing escalation
28-
of privileges. We can spawn a medium integrity command prompt, after spawning a low
29-
integrity command prompt, by using the Win+Shift+# combination to specify the
30-
position of the command prompt on the taskbar. We can then broadcast our command
31-
and hope that the user is away and doesn't corrupt it by interacting with the UI.
32-
Broadcast issue affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2,
33-
Server 2012, RT. But Spawning a command prompt with the shortcut key does not work
34-
in Vista so you will have to check if the user is already running a command prompt
35-
and set SPAWN_PROMPT false. The WEB technique will execute a powershell encoded
36-
payload from a Web location. The FILE technique will drop an executable to the
37-
file system, set it to medium integrity and execute it. The TYPE technique will
38-
attempt to execute a powershell encoded payload directly from the command line but
39-
it may take some time to complete.
25+
Due to a problem with isolating window broadcast messages in the Windows kernel,
26+
an attacker can broadcast commands from a lower Integrity Level process to a
27+
higher Integrity Level process, thereby effecting a privilege escalation. This
28+
issue affects Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, and
29+
RT. Note that spawning a command prompt with the shortcut key combination Win+Shift+#
30+
does not work in Vista, so the attacker will have to check if the user is already
31+
running a command prompt and set SPAWN_PROMPT false.
32+
33+
Three exploit techniques are available with this module. The WEB technique will
34+
execute a powershell encoded payload from a Web location. The FILE technique
35+
will drop an executable to the file system, set it to medium integrity and execute
36+
it. The TYPE technique will attempt to execute a powershell encoded payload directly
37+
from the command line, but may take some time to complete.
4038
},
4139
'License' => MSF_LICENSE,
4240
'Author' =>

0 commit comments

Comments
 (0)