CVE-2013-5065
HIGH KEVMicrosoft Windows XP/Server 2003 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2013-5065 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022. EIP tracks 4 public exploits from researchers including Metasploit, ryujin, Tomislav Paskalev.
AI-analyzed exploit summary This Metasploit module exploits a NULL pointer dereference vulnerability in the ndproxy.sys driver on Windows XP SP3 and Windows Server 2003 SP2. It leverages unsafe array indexing during IO control code processing to achieve local privilege escalation.
Description
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
Exploits (4)
This Metasploit module exploits a NULL pointer dereference vulnerability in the ndproxy.sys driver on Windows XP SP3 and Windows Server 2003 SP2. It leverages unsafe array indexing during IO control code processing to achieve local privilege escalation.
This exploit leverages a null pointer dereference vulnerability in the Windows NDProxy driver (CVE-2013-5065) to achieve local privilege escalation (LPE) to SYSTEM. It allocates executable memory at the null page, writes shellcode, and triggers the vulnerability via a crafted DeviceIoControl call.
This exploit leverages a vulnerability in NDProxy.sys (CVE-2013-5065) to achieve local privilege escalation on Windows XP SP3 and Windows 2003 SP2 by writing shellcode to a specific memory location and triggering it via DeviceIoControl.
The repository contains only a README.md file with no technical details or exploit code. It appears to be a placeholder or stub for CVE-2013-5065.
References (5)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H