CVE-2011-3360

Wireshark <1.4.9, <1.6.2 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2011-3360. PoCs published by Metasploit, Haifei Li, sinn3r, including Metasploit module exploits/windows/misc/wireshark_lua.

AI-analyzed exploit summary This Metasploit module exploits CVE-2011-3360 in Wireshark by serving a malicious 'console.lua' script alongside a fake pcap file. When Wireshark opens the pcap, it executes the Lua script, leading to arbitrary code execution.

Description

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/18125

View Code ZIP pw:eip

This Metasploit module exploits CVE-2011-3360 in Wireshark by serving a malicious 'console.lua' script alongside a fake pcap file. When Wireshark opens the pcap, it executes the Lua script, leading to arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Wireshark 1.6.0 to 1.6.1, 1.4.0 to 1.4.8

No auth needed

Prerequisites: Victim must open the malicious pcap file in Wireshark · Network access to serve the malicious files

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

by Haifei Li, sinn3r · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/wireshark_lua.rb