CVE-2006-5586

This exploit leverages a GDI vulnerability (CVE-2006-5586) to achieve local privilege escalation by manipulating a palette object's kernel pointer in the GDI shared section, allowing arbitrary code execution in kernel mode.

This exploit demonstrates a local privilege escalation (LPE) vulnerability in Windows GDI (CVE-2006-5586) by manipulating the GDI table to overwrite a win32k.sys SSDT entry, allowing arbitrary kernel code execution. The PoC allocates memory at address 0x2, crafts a payload, and triggers the vulnerability via DeleteObject.

This exploit targets a vulnerability in Microsoft Windows GDI (CVE-2006-5586) via maliciously crafted .ANI files, leading to remote elevation of privilege. The exploit is packaged as a binary (ZIP) and was historically used in attacks (MS07-017).