The Microsoft POSIX subsystem implementation is prone to a local buffer overflow vulnerability. A local attacker may exploit this vulnerability in order to run code with elevated privileges, fully compromising the vulnerable computer. This module exploits that vulnerability to install an agent on the target. In some cases after run this module, the RevertToSelf module makes it possible to escalate to SYSTEM privileges, leaving the agent with full control of the remote host.

There is an authentication vulnerability in the Windows debugging subsystem (smss). This allows any user to obtain a handle with any access of any process running. With this handle an agent is injected in a SYSTEM process.

This module exploits a vulnerability in WinPcap. The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters to obtain system privileges.

This module connects to Telephony Service and sends a message via lineSetAppPriorityW winapi32 that produces a buffer overflow and an agent will be installed.

The hardware detection functionality in the Windows Shell in Microsoft Windows XP, and Server 2003 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."

This module exploits a vulnerability in Windows XP and Windows 2003 when the 0xCA002813 function is invoked with a specially crafted parameter. The IOCTL 0xCA002813 handler in the SECDRV.SYS device driver in Macrovision products, installed by default in Windows XP and Windows 2003, allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.

This module exploits a vulnerability in Windows I2O Utility Filter Driver when the 0x222F80 IOCTL in i2omgmt.sys is invoked with a specially crafted parameter. The IOCTL 0x222F80 handler in the i2omgmt.sys device driver in Windows I2O Utility Filter Driver allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.

This module exploits a vulnerability in the way that Microsoft Windows manages GDI kernel structures in shared memory. An attacker could remap a global shared memory section that is defined to be read-only to read-write allowing them to execute arbitrary code and gain additional privileges on the target system.

When the "vmci.sys" driver processes a crafted call from user an array index out of bound is exploited.

Using the VMWare VMCI Arbitrary Code Execution vulnerability it is possible run code in the host machine. This module sends a malformed message through hardware port to host exploiting the vmware-vmx.exe process and installing an agent. Source agent in guest machine must have administrator/system privileges.