CVE-2013-3956
EXPLOITEDNovell Client - Local Privilege Escalation via NICM.SYS IOCTL 0x143B6B
Title source: llmExploitation Summary
CVE-2013-3956 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including sickness, Metasploit, Unknown, juan vazquez, including a Metasploit module exploits/windows/local/novell_client_nicm.
AI-analyzed exploit summary This exploit targets a privilege escalation vulnerability in Novell Client 2 SP3 (nicm.sys 3.1.11.0) on Windows 7 and 8 (x86). It leverages a vulnerable IOCTL (0x00143B6B) to execute shellcode that steals the SYSTEM token, granting elevated privileges.
Description
The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista and Windows Server 2008; and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted 0x143B6B IOCTL call.
Exploits (3)
This exploit targets a privilege escalation vulnerability in Novell Client 2 SP3 (nicm.sys 3.1.11.0) on Windows 7 and 8 (x86). It leverages a vulnerable IOCTL (0x00143B6B) to execute shellcode that steals the SYSTEM token, granting elevated privileges.
This Metasploit module exploits a flaw in the nicm.sys driver (CVE-2013-3956) to execute arbitrary code in kernel space via an ioctl request with code 0x143B6B, allowing local privilege escalation on Windows 7 SP1 with Novell Client 2 SP3.
This Metasploit module exploits a flaw in the Novell Client 2 SP3 nicm.sys driver to execute arbitrary code in kernel space via a user-provided pointer used as a function pointer in ioctl requests. It includes token-stealing shellcode for local privilege escalation on Windows 7 SP1.