This module exploits an information disclosure vulnerability in Microsoft Windows Snipping Tool. A malicious web page invokes the ms-screensketch URI handler with an attacker-controlled UNC path. When the victim allows the browser to open Snipping Tool, the application connects to the SMB server and discloses the current user's Net-NTLM response. This exploit does not install an agent.

A vulnerability chain in Vim enables arbitrary OS command execution via a specially crafted file. The tabpanel option lacks the P_MLE flag, which allows a modeline to inject a %{expr} string even when modelineexpr is disabled. While the expression is initially evaluated within a sandbox, the autocmd_add() function fails to call check_secure(). This oversight allows sandboxed code to register an autocommand that triggers after the sandbox environment has been exited, resulting in a full sandbox escape.

This vulnerability involves the improper neutralization of special elements used in a command ('command injection') in Windows MSHTML, allowing an unauthorized attacker to execute a crafted DLL file located in a shared folder and bypass Mark of the Web. The steps performed by the exploit are: Creates a DLL containing an Impact agent and places it in an SMB file share. It also creates an .lnk file for direct access. Using the provided link, download the .lnk file in the browser. Because some browsers may change the .lnk extension, you can set ATTACH_FILE_NAME to end with .zip to send the .lnk inside a ZIP file. If necessary, unzip the file and run the .lnk file. Alternatively, run the .lnk directly from the SMB share using the direct link. If the target can access the SMB share on the Impact machine, the agent will be deployed without Mark of the Web or popup warnings.

The vulnerability relates to an improper neutralization of special elements used in a command ('command injection') in Windows Notepad App, this allows an unauthorized attacker to execute code locally.

This module exploits a high-severity vulnerability in Windows File Explorer. The exploit works by creating a specially crafted .lnk (shortcut) file that, when placed in a folder viewed by a victim, forces the system to automatically connect to an attacker-controlled SMB server. This connection happens without any user interaction and results in the victim's NTLM hash being sent to the attacker. It is possible to use tools like "John the Ripper" to attempt decrypting the original password associated with the hash.

This exploit leverages an information disclosure vulnerability in Microsoft Windows. By crafting a malicious .library-ms file, an attacker can coerce authentication to an untrusted server and steal NTLMv2 hashes. This exploit does not install an agent, it manages to obtain the NTLMv2 hash of a legitimate user. It is possible to use tools like "John the Ripper" to attempt decrypting the original password associated with the hash.

Microsoft Windows Internet Shortcut is prone to a vulnerability that may allow remote attackers to bypass the SmartScreen security feature. The specific flaw exists within the handling of Internet Shortcut (.URL) files. The issue results from the lack of a security check on chained Internet Shortcut files. An attacker can leverage this vulnerability to execute code in the context of the current user.

This exploit leverages an Information Disclosure vulnerability in Microsoft WordPad. The vulnerability is associated with legacy functionality to convert an OLE 1 storage object (OLESTREAM) to the new IStorage format. By crafting a file with a malicious OLE 1 LinkedObject, an attacker can coerce authentication to an untrusted server and steal NTLM hashes. This exploit does not install an agent, it manages to obtain the NTML hash of a legitimate user.

In WinRAR versions prior to 6.23, there is a vulnerability that allows attackers to execute arbitrary code. This vulnerability occurs when a user tries to open a harmless file within a ZIP archive. The issue arises when the ZIP archive contains a benign file, such as a regular .PDF file, and also a folder with the same name as the benign file. During an attempt to access the benign file, the contents of the folder, which may include executable content, are processed, leading to the execution of arbitrary code.

Foxit PDF Reader, in an oversight, exposes a JavaScript interface capable of writing arbitrary files. This mishap is what makes the software susceptible to attacks. An adversary can manipulate this vulnerability to execute code within the context of the current user, thereby gaining unauthorized control over the system. The vulnerable method is exportXFAData. This exploit will write the agent to the startup folder. This means that the user must logoff and login again in order to execute the agent.