Exploitation Summary
EIP tracks 6 public exploits for CVE-2014-4971.
PoCs published by Metasploit, KoreLogic, Matt Bergin, Spencer McIntyre, including Metasploit module exploits/windows/local/bthpan.
AI-analyzed exploit summary This is a Metasploit module for CVE-2014-4971, a privilege escalation vulnerability in Microsoft Bluetooth Personal Area Networking (BthPan.sys). It exploits a memory corruption flaw to overwrite HalDispatchTable and execute arbitrary kernel code.
Description
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Exploits (6)
This is a Metasploit module for CVE-2014-4971, a privilege escalation vulnerability in Microsoft Bluetooth Personal Area Networking (BthPan.sys). It exploits a memory corruption flaw to overwrite HalDispatchTable and execute arbitrary kernel code.
This Metasploit module exploits CVE-2014-4971, an arbitrary write vulnerability in MQAC.sys, to escalate privileges to SYSTEM on Windows XP SP3. It uses token stealing to achieve privilege escalation.
This exploit leverages a write-what-where vulnerability in BthPan.sys on Windows XP SP3 via an unvalidated OutputBuffer in DeviceIoControlFile calls. It allows arbitrary memory writes to escalate privileges by overwriting HalDispatchTable+0x4 and executing shellcode via NtQueryIntervalProfile.
The exploit demonstrates a write-what-where vulnerability in MQAC.sys on Windows XP SP3, allowing arbitrary memory writes via a crafted DeviceIoControlFile call. It includes a Python PoC that escalates privileges by overwriting HalDispatchTable+0x4 and triggering shellcode execution via NtQueryIntervalProfile.
This Metasploit module exploits CVE-2014-4971, a privilege escalation vulnerability in the Microsoft Bluetooth Personal Area Networking (BthPan.sys) driver. It leverages memory corruption to overwrite the HalDispatchTable and execute arbitrary kernel code, elevating privileges to SYSTEM on Windows XP SP3.
This Metasploit module exploits CVE-2014-4971, an arbitrary kernel memory write vulnerability in MQAC.sys on Windows XP SP3. It escalates privileges to SYSTEM by overwriting the HalDispatchTable and injecting a payload into a SYSTEM process.