CVE-2013-3881
EXPLOITEDWindows 7 SP1 and Windows Server 2008 R2 SP1 - Local Privilege Escalation via Win32k NULL Page
Title source: llmExploitation Summary
CVE-2013-3881 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including Metasploit, Seth Gibson, Dan Zentner, Matias Soler, Spencer McIntyre, including a Metasploit module exploits/windows/local/ms13_081_track_popup_menu.
AI-analyzed exploit summary This Metasploit module exploits a NULL pointer dereference in win32k.sys via TrackPopupMenuEx, leading to local privilege escalation on Windows 7 SP0/SP1. It injects a reflective DLL into a notepad process to trigger the vulnerability and execute arbitrary payloads.
Description
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a crafted application, aka "Win32k NULL Page Vulnerability."
Exploits (2)
This Metasploit module exploits a NULL pointer dereference in win32k.sys via TrackPopupMenuEx, leading to local privilege escalation on Windows 7 SP0/SP1. It injects a reflective DLL into a notepad process to trigger the vulnerability and execute arbitrary payloads.
This Metasploit module exploits a NULL pointer dereference vulnerability in win32k.sys via TrackPopupMenuEx, allowing local privilege escalation on Windows 7 SP0/SP1. It reflectively injects a DLL to trigger the exploit and execute a payload.