CVE-2011-2005

This Metasploit module exploits a kernel memory corruption vulnerability in afd.sys (CVE-2011-2005) to achieve local privilege escalation by overwriting the HalDispatchTable and triggering execution via NtQueryIntervalProfile. It elevates to SYSTEM and injects payload into another SYSTEM process.

This is a functional privilege escalation exploit for CVE-2011-2005 targeting the Afd.sys driver vulnerability in Windows XP and Windows Server 2003. It leverages a kernel memory corruption flaw to execute arbitrary code in kernel mode, specifically stealing a SYSTEM token for privilege escalation.

This repository contains documentation and configuration scripts for a collection of Windows exploits, including CVE-2003-0352, CVE-2006-3439, CVE-2008-1084, and others. It includes README files in both Chinese and English, as well as a Python script for generating documentation.