Exploitation Summary
EIP tracks 2 public exploits for CVE-2007-0843. PoCs published by 3APA3A, z3APA3A.
AI-analyzed exploit summary This exploit demonstrates a local information disclosure vulnerability in Microsoft Windows by monitoring directory changes, including files the user has no access to, via the ReadDirectoryChangesW API. It leverages the FILE_FLAG_BACKUP_SEMANTICS flag to bypass permission checks and observe file operations.
Description
The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allows local users to bypass permissions by opening a directory with LIST (READ) access and using ReadDirectoryChangesW to monitor changes of files that do not have LIST permissions, which can be leveraged to determine filenames, access times, and other sensitive information.
Exploits (2)
This exploit demonstrates a local information disclosure vulnerability in Microsoft Windows by monitoring directory changes, including files the user has no access to, via the ReadDirectoryChangesW API. It leverages the FILE_FLAG_BACKUP_SEMANTICS flag to bypass permission checks and observe file operations.
The repository contains a functional exploit PoC for CVE-2007-0843, which leverages the ReadDirectoryChangesW API to monitor directory changes, including files the user has no access to, due to improper permission handling in Windows. The code demonstrates the vulnerability by creating a directory handle with FILE_FLAG_BACKUP_SEMANTICS and monitoring changes without proper access checks.