CVE-2013-3956

This exploit targets a privilege escalation vulnerability in Novell Client 2 SP3 (nicm.sys 3.1.11.0) on Windows 7 and 8 (x86). It leverages a vulnerable IOCTL (0x00143B6B) to execute shellcode that steals the SYSTEM token, granting elevated privileges.

This Metasploit module exploits a flaw in the nicm.sys driver (CVE-2013-3956) to execute arbitrary code in kernel space via an ioctl request with code 0x143B6B, allowing local privilege escalation on Windows 7 SP1 with Novell Client 2 SP3.

This Metasploit module exploits a flaw in the Novell Client 2 SP3 nicm.sys driver to execute arbitrary code in kernel space via a user-provided pointer used as a function pointer in ioctl requests. It includes token-stealing shellcode for local privilege escalation on Windows 7 SP1.