This module exploits a Java unsafe reflection and a Server Side Request Forgery vulnerabilities present in ProxygenController class via POST requests to the /ui/h5-vsan/rest/proxy/service endpoint. The deployed agent will run with the vsphere-ui user account privileges.
This module exploits a deserialization vulnerability present in MeetingPollHandler handler when using a ProposeOptionsMeetingPollParameters type. The deployed agent will run with the SYSTEM privileges.
This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.
An elevation of privilege vulnerability exists in the way the win32kbase component handles objects in memory.
The Windows kernel is prone to a race condition bug when creating/deleting symbolic links, since it does not properly acquire/release kernel locks.
This module exploits a vulnerability in Microsoft MSHTML, which can be leveraged to execute arbitrary code on vulnerable machines by convincing an unsuspecting user to visit a malicious web site.
The MODAPI.sys driver in MSI Dragon Center 2.0.104.0 exposes functionality that allows low-privileged users to write an arbitrary value to a Model-Specific Register (MSR) at the specified address via specially crafted IOCTL requests.
An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center exposes functionality that allows low-privileged users to interact with the device and exploit a stack buffer overflow via specially crafted IOCTL requests and elevate system privileges.
An attacker who successfully exploited the vulnerability could execute code with elevated permissions.