CVE-2004-0213
HIGHWindows 2000 - Privilege Escalation via Utility Manager Shatter Attack
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2004-0213. PoCs published by kralor, bkbll, Cesar Cerrudo.
AI-analyzed exploit summary This exploit targets CVE-2004-0213, a local privilege escalation vulnerability in Windows 2000 Utility Manager. It leverages language-specific window names to spawn a system-level command shell via a crafted sequence of GUI interactions and socket-based command execution.
Description
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.
Exploits (4)
This exploit targets CVE-2004-0213, a local privilege escalation vulnerability in Windows 2000 Utility Manager. It leverages language-specific window names to spawn a system-level command shell via a crafted sequence of GUI interactions and socket-based command execution.
This exploit leverages a local privilege escalation vulnerability in Windows 2000 Utility Manager by manipulating window messages to execute a command prompt with SYSTEM privileges. It dynamically adapts to system language settings to ensure compatibility.
This exploit targets CVE-2004-0213, a local privilege escalation vulnerability in the Microsoft Windows POSIX subsystem. It leverages a buffer overflow in the POSIX subsystem to execute arbitrary code with SYSTEM privileges by injecting shellcode into a suspended process.
This exploit leverages a local privilege escalation vulnerability in Windows 2000 Utility Manager by manipulating window messages to spawn a command shell with SYSTEM privileges. It automates UI interactions to bypass intended restrictions and execute cmd.exe.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H