CVE-2013-3661

This Metasploit module exploits a local privilege escalation vulnerability in Windows (CVE-2013-3660) by leveraging uninitialized data in EPATHOBJ::pprFlattenRec to corrupt memory and escalate privileges to SYSTEM. It includes process migration and payload execution capabilities.

This exploit targets a memory corruption vulnerability in the Windows kernel (win32k.sys) via the EPATHOBJ::pprFlattenRec function, allowing local privilege escalation by manipulating PATHRECORD structures through GDI operations like PolyDraw and FlattenPath.

This exploit leverages a race condition in the Windows kernel's EPATHOBJ::bFlatten function to achieve arbitrary memory writes, leading to a SYSTEM privilege escalation. The PoC uses a watchdog thread to patch a compromised linked list while the kernel is stuck in a loop, demonstrating a reliable LPE on Windows 8.