MS Windows InternalOpenColorProfile Heap Overflow PoC (MS08-046)
EMR_SETICMPROFILEA Heap Overflow DOS
By Ac!dDrop
related to MS08-046
Tested on windows Xp professional Sp2
mscms.dll 5.1.2600.2709
gdi32.dll 5.1.2600.2818
Posts
MS Windows GDI+ Proof of Concept (MS08-052) #2
-----------------------------------------------------------------------------------------
Operating System: XP SP2
Gdiplus.dll Version: 5.1.3102.2180
Credit:
John Smith,
Evil Fingers
GIF Template Reference: http://www.sweetscape.com/010editor/templates/files/GIFTemplate.bt
PoC Link: http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt
http://www.evilfingers.com/patchTuesday/PoC.php
========================================================================
MS Windows Token Kidnapping本地提权的解决方案
InsomniaShell
InsomniaShell is a tool for use during penetration tests, when you have ability to upload or create an arbitrary .aspx page. This .aspx page is an example of using native calls through pinvoke to provide either a reverse shell or a bind shell.
It has the added advantage of searching through all accessible processes looking for a SYSTEM or Administrator token to use for impersonation. InsomniaShell.zip
扫权限.aspx
作者： cnqing
ScanWriterable.aspx
<%@ Page Language="C#" ValidateRequest="false" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Text" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>ScanWrtieable</title>
</head>
<body>
MS Windows 2003 Token Kidnapping Local Exploit PoC
鬼仔：提权很好用，直接system。文章末尾贴个TR那里的测试图。
编译好的： http://www.blogjava.net/Files/baicker/Churrasco.rar
（via 009
）
From：http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html
It has been a long time since Token Kidnapping presentation ( http://www.argeniss.com/research/TokenKidnapping.pdf
)
was published so I decided to release a PoC exploit for Win2k3 that alows to execute code under SYSTEM account.