Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.
Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Witten by our own internal team, you can trust they have been thoroughly tested and validated by our experts.
The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:
What are the most critical attacks from the attacker’s perspective?
What new vulnerabilities are more likely to be exploited in real attacks?
What exploits are the most valuable for Core Impact?
Once an exploit is approved, its priority order considers the following variables:
Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed.
Target Environment Setup: OS, application prevalence, version and special configurations needed.
Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc.
Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation.
Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges.
Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.
Stay Informed of New Core Certified Exploits
Subscribe to receive regular email updates on new exploits available for Core Impact
Browse the Core Certified Exploit Library
We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications.
Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.
Title
Description
Date Added
CVE Link
Exploit Platform
Exploit Type
Product Name
Mac OS X pppd Plugin Loading Privilege Escalation Exploit
This module exploits a vulnerability in the The PPP daemon (pppd) in Apple Mac OS X which allows an attacker to load arbitrary plugins and gain root privileges by bypassing this check.
Mac OS X smcFanControl Local Privilege Escalation Exploit
This module exploits a buffer overflow vulnerability in smcFanControl in Apple Mac OS X 10.4 that allows local users to get code execution with elevated privileges.
Microsoft Windows CreateWindow Function Callback Exploit (MS10-032)
When the "CreateWindow" function is called, the Windows kernel calls to user through callbacks pushing in the stack many arguments to be used for the callback function. One argument of these is the hParent Window. After that, the windows kernel re-uses this argument. If this argument is modified by the callback function, the bug is triggered.
Microsoft Windows CreateWindow Function Callback Exploit (MS10-048)
When the "CreateWindow" function is called, the Windows kernel calls to user through callbacks pushing in the stack many arguments to be used for the callback function. One argument of these is the hParent Window. After that, the windows kernel re-uses this argument. If this argument is seted with the pseudo-handle 0xfffffffe or 0xffffffff by the callback function, the bug is triggered.
Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows to execute arbitrary code via crafted inputs to ASP pages.
Microsoft Internet Explorer File Integrity Level Protected Mode Bypass Privilege Escalation Exploit (MS11-057)
The Protected Mode of Microsoft Internet Explorer can be bypassed by exploiting a logical flaw when checking the Integrity Level of a file. This vulnerability allows an agent running in the context of iexplore.exe with Low Integrity Level to install a new agent that will run with Medium Integrity Level, by launching the browser against an HTML file having Untrusted Integrity Level. This module needs to re-exploit Internet Explorer with any web browser exploit that has been proved successful against the target (i.e an exploit that was able to install an agent on the target).
Microsoft Internet Explorer IESetProtectedModeRegKeyOnly Protected Mode Escape Exploit (MS13-097)
The IESetProtectedModeRegKeyOnly() function in the ieframe.dll library of Microsoft Internet Explorer calls the RegCreateKeyEx registry function when running with Medium Integrity Level over a registry key that is writable by a sandboxed IE instance. This can be abused to overwrite IE's Elevation Policy by creating symbolic links in the Windows Registry in order to escape from the Internet Explorer Protected Mode sandbox.
Microsoft Internet Explorer NonQuotedCmdLine Protected Mode Escape Exploit (MS13-055)
An error in the way the GetSanitizedParametersFromNonQuotedCmdLine() function in the Internet Explorer broker process handles command-line arguments when trying to launch a program can be exploited to escape from the Internet Explorer Protected Mode/Enhanced Protected Mode sandbox. This module allows an agent running in the context of iexplore.exe with Low Integrity Level/AppContainer Integrity Level to escalate privileges in order to install a new agent that will run with Medium Integrity Level.
Microsoft Internet Explorer XBAP Protected Mode Bypass Privilege Escalation Exploit
This module exploits a privilege escalation vulnerability in the Protected Mode feature of Internet Explorer. By executing an XBAP application from an agent running with Low Integrity Level, it is possible to escalate privileges in order to install a new agent that will run with Medium Integrity Level.
Windows
Exploits / Local / Privilege Escalation
Impact
Microsoft .NET Runtime Optimization Service Privilege Escalation Exploit
The .NET Runtime Optimization Service, part of the .NET Framework, is prone to a privilege escalation vulnerability, which can be exploited by some local non-admin users to execute arbitrary code with SYSTEM privileges. This exploit relies on a flaw on the file permissions of the service's executable file that allows it to be overwritten by some non-admin users. This module can be used from agents running with "Super User" privileges.
Windows
Exploits / Local / Privilege Escalation
Impact
Microsoft NtUserMessageCall Kernel Privilege Escalation Exploit (MS08-025)
An elevation of privilege vulnerability exists due to the Windows kernel improperly validating input passed from user mode to the kernel. The vulnerability could allow an attacker to run code with elevated privileges.
Microsoft Windows Administrator UAC Elevation Bypass
This module uses two different strategies to bypass UAC. The first strategy uses the ICMLuaUtil elevated COM interface to execute a new agent with high integrity level. This method works on 32-bit systems, from Windows 7 up to the latest version. The second one leverages on the Program Compatibility Assistant (PCA) and environment variables expansion to perform a Dll hijack and run a new agent with high integrity level. This method works on 64-bit systems, from Windows 7 up to the latest version, and it is compatible with the highest UAC level (Always Notify).
Windows
Exploits / Local / Privilege Escalation
Impact
Microsoft Windows AFD AfdConnect Privilege Escalation Exploit (MS11-046)
The Ancillary Function Driver (AFD.sys) present in Microsoft Windows is vulnerable to an arbitrary pointer overwrite. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by sending a specially crafted IOCTL (0x12007) to the vulnerable driver.
Microsoft Windows AFD AfdJoinLeaf Privilege Escalation Exploit (MS11-080)
The Ancillary Function Driver (AFD.sys) present in Microsoft Windows is vulnerable to an arbitrary pointer overwrite. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by sending a specially crafted IOCTL (0x120BB) to the vulnerable driver.
Microsoft Windows AFD Driver Local Privilege Escalation Exploit (MS08-066)
This module exploits a vulnerability in Windows Ancillary function driver when the 0x1203F IOCTL in afd.sys is invoked with a specially crafted parameter. The IOCTL 0x1203F handler in the afd.sys function driver allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.
Microsoft Windows Class Name String Atom Privilege Escalation Exploit (MS12-041)
An error in the way that the Windows kernel handles string atoms when registering a new window class allows unprivileged users to re-register atoms of privileged applications. This vulnerability can be exploited by local unprivileged users to execute arbitrary code with SYSTEM privileges. This exploit will lock the machine screen (similar to pressing Ctrl+Alt+Del and then clicking on 'Lock this computer'), and the windows theming will be disabled until the machine is restarted.
Microsoft Windows CSRSS SrvSetConsoleNumberOfCommand Exploit (MS11-056)
This exploits sets the command history number in a value greater than 0x7fff. When a new command is sent to "cmd.exe", a CSRSS memory corruption is produced and the CSRSS process control is taken.
Microsoft Windows Font Library File Buffer Overrun Vulnerability Exploit (MS11-077)
When a crafted ".fon" file is loaded by Windows Kernel this produces a kernel heap overflow. This module exploits this vulnerability filling the kernel memory via heap spraying and building a fake chunk header.
Microsoft Windows GP Trap Handler Privilege Escalation Exploit
Incorrect assumptions in the support code of legacy 16bit applications in Microsoft Windows operating systems allows local users to gain system privileges via the "NtVdmControl" system call.
Microsoft Windows MQAC.sys Arbitrary Write Local Privilege Escalation Exploit
The MQ Access Control Driver (mqac.sys) present in Microsoft Windows is vulnerable to an arbitrary pointer overwrite. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by sending a specially crafted IOCTL (0x1965020F) to the vulnerable driver.
Microsoft Windows On-Screen Keyboard Mouse Input Privilege Escalation Exploit (MS14-039)
The On-Screen Keyboard application of Microsoft Windows is prone to a privilege escalation vulnerability when handling mouse input originated from a process running with Low Integrity Level. This vulnerability allows an agent running with Low Integrity Level to escalate privileges in order to install a new agent that will run with Medium Integrity Level, by sending mouse input to the On-Screen Keyboard when its input mode is set to "Hover over keys".