@@ -22,21 +22,19 @@ def initialize(info={})
22
22
super ( update_info ( info ,
23
23
'Name' => 'MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation' ,
24
24
'Description' => %q{
25
- The Windows kernel does not properly isolate broadcast messages from low integrity
26
- applications from medium or high integrity applications. This allows commands to be
27
- broadcasted to an open medium or high integrity command prompts allowing escalation
28
- of privileges. We can spawn a medium integrity command prompt, after spawning a low
29
- integrity command prompt, by using the Win+Shift+# combination to specify the
30
- position of the command prompt on the taskbar. We can then broadcast our command
31
- and hope that the user is away and doesn't corrupt it by interacting with the UI.
32
- Broadcast issue affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2,
33
- Server 2012, RT. But Spawning a command prompt with the shortcut key does not work
34
- in Vista so you will have to check if the user is already running a command prompt
35
- and set SPAWN_PROMPT false. The WEB technique will execute a powershell encoded
36
- payload from a Web location. The FILE technique will drop an executable to the
37
- file system, set it to medium integrity and execute it. The TYPE technique will
38
- attempt to execute a powershell encoded payload directly from the command line but
39
- it may take some time to complete.
25
+ Due to a problem with isolating window broadcast messages in the Windows kernel,
26
+ an attacker can broadcast commands from a lower Integrity Level process to a
27
+ higher Integrity Level process, thereby effecting a privilege escalation. This
28
+ issue affects Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, and
29
+ RT. Note that spawning a command prompt with the shortcut key combination Win+Shift+#
30
+ does not work in Vista, so the attacker will have to check if the user is already
31
+ running a command prompt and set SPAWN_PROMPT false.
32
+
33
+ Three exploit techniques are available with this module. The WEB technique will
34
+ execute a powershell encoded payload from a Web location. The FILE technique
35
+ will drop an executable to the file system, set it to medium integrity and execute
36
+ it. The TYPE technique will attempt to execute a powershell encoded payload directly
37
+ from the command line, but may take some time to complete.
40
38
} ,
41
39
'License' => MSF_LICENSE ,
42
40
'Author' =>
0 commit comments