CVE-2002-1230
Windows 2000 - Local Privilege Escalation via WM_TIMER Message Handling
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2002-1230. PoCs published by Serus, anonymous, Ovidio Mallo.
AI-analyzed exploit summary This exploit leverages the Winlogon NetDDE Agent vulnerability (CVE-2002-1230) to achieve local privilege escalation by sending a WM_COPYDATA message with shellcode and triggering execution via a WM_TIMER message. It targets Windows 2000 and XP by bruteforcing memory addresses to locate the injected shellcode.
Description
NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by GetAd, aka "Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation."
Exploits (10)
This exploit leverages the Winlogon NetDDE Agent vulnerability (CVE-2002-1230) to achieve local privilege escalation by sending a WM_COPYDATA message with shellcode and triggering execution via a WM_TIMER message. It targets Windows 2000 and XP by bruteforcing memory addresses to locate the injected shellcode.
This exploit leverages the Winlogon NetDDE Agent vulnerability (CVE-2002-1230) to achieve local privilege escalation on Windows 2000 by sending a WM_COPYDATA message with shellcode and triggering execution via a WM_TIMER message.
This is a technical writeup describing a design flaw in the Win32 API related to inter-window message passing, which can be exploited for local privilege escalation (LPE) by targeting windows of higher-privileged processes. It references multiple papers and proofs-of-concept, including Shatter attacks and specific Windows messages like WM_TIMER and WM_SETTEXT.
The document describes a Win32 API design flaw related to inter-window message passing, which can be exploited for local privilege escalation (LPE) by targeting windows of higher-privileged processes. It references multiple papers and proofs-of-concept, including Shatter attacks and specific Windows messages like WM_TIMER and WM_SETTEXT.
This exploit demonstrates a Shatter attack against Win32 applications with listview controls, leveraging inter-window message passing to inject shellcode and overwrite a critical memory address (SEH handler). It targets local privilege escalation by manipulating window messages like LVM_SETCOLUMNWIDTH and HDM_GETITEMRECT.
This exploit demonstrates a Shatter attack against Windows applications with tab controls, specifically targeting McAfee A/V products. It injects shellcode into a known memory location and overwrites a critical address to achieve local privilege escalation.
This exploit demonstrates a Shatter attack against Windows applications using progress bar controls. It injects shellcode into a known memory location and overwrites a critical address to achieve local privilege escalation.
This exploit demonstrates a Shatter attack against Windows applications using status bar controls. It brute-forces heap addresses, injects shellcode, and overwrites SEH to achieve local privilege escalation.
This exploit demonstrates a Shatter attack against Windows applications using the CommCtrl 6.0 Button control. It injects shellcode into a known memory location and overwrites a critical address to achieve local privilege escalation.
This exploit leverages the Win32 message passing vulnerability (CVE-2002-1230) to achieve local privilege escalation by targeting the Utility Manager window. It uses techniques like LVM_SORTITEMS and HDM_GETITEMRECT to overwrite SEH and execute shellcode.