CVE-2013-3660

This exploit leverages a race condition in the Windows kernel's EPATHOBJ::bFlatten function to achieve arbitrary memory writes, leading to a SYSTEM privilege escalation. The PoC uses a watchdog thread to patch a compromised linked list while the kernel is stuck in a loop, demonstrating a reliable LPE on Windows 8.

This exploit targets a memory corruption vulnerability in the Windows kernel (win32k.sys) via the EPATHOBJ::pprFlattenRec function, allowing local privilege escalation by manipulating PATHRECORD structures through crafted PolyDraw operations.

This Metasploit module exploits a local privilege escalation vulnerability in Windows (CVE-2013-3660) by corrupting memory via uninitialized data in EPATHOBJ::pprFlattenRec. It migrates to a new process, loads an exploit DLL, and escalates privileges to SYSTEM.

This Metasploit module exploits a memory corruption vulnerability in EPATHOBJ::pprFlattenRec due to uninitialized data usage, allowing local privilege escalation on vulnerable Windows systems. It checks the target system's win32k.sys version for vulnerability and reflectively injects a DLL payload to trigger the exploit.