CVE-2015-0096
EXPLOITEDMicrosoft Windows Shell LNK Code Execution
Title source: metasploitExploitation Summary
CVE-2015-0096 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Ivanlef0u, Michael Heerklotz, juan vazquez, Uncredited, Yorick Koster, Spencer McIntyre, including a Metasploit module exploits/windows/smb/ms15_020_shortcut_icon_dllloader.
AI-analyzed exploit summary This exploit leverages a vulnerability in Windows Shell32.dll where a maliciously crafted .LNK file can trigger arbitrary code execution via LoadLibraryW. The PoC demonstrates the exploit by loading a DLL from a controlled path, as shown in the debug output.
Description
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability."
Exploits (5)
This exploit leverages a vulnerability in Windows Shell32.dll where a maliciously crafted .LNK file can trigger arbitrary code execution via LoadLibraryW. The PoC demonstrates the exploit by loading a DLL from a controlled path, as shown in the debug output.
This Metasploit module exploits CVE-2015-0096 by generating a malicious .LNK file that loads a DLL from an SMB share, achieving remote code execution. It leverages a vulnerability in the MS10-046 patch to abuse Windows Shortcut file handling.
This Metasploit module exploits CVE-2017-8464, a variant of CVE-2015-0096, by creating a malicious .LNK file that loads a DLL from a crafted Control Panel applet, achieving local privilege escalation on Windows systems.
This Metasploit module exploits CVE-2017-8464, a vulnerability in Windows LNK file handling, by generating a malicious .LNK file that loads a DLL from a specified path, achieving remote code execution. It bypasses the CPL whitelist by using a SpecialFolderDataBlock with a Control Panel folder ID.
This Metasploit module exploits CVE-2015-0096 by generating a malicious .LNK file and a DLL payload to achieve remote code execution via improper handling of Windows Shortcut files. It leverages a vulnerability in the MS10-046 patch to load a malicious DLL from a UNC path.