CVE-2015-2509
Windows Media Center - Remote Code Execution via Crafted MCL File
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-2509.
PoCs published by Metasploit, R-73eN, sinn3r, including Metasploit module exploits/windows/fileformat/ms15_100_mcl_exe.
AI-analyzed exploit summary This Metasploit module exploits CVE-2015-2509 by crafting a malicious .mcl file that triggers a UNC path download, leading to arbitrary code execution via Windows Media Center. The exploit generates a payload executable and embeds it in the MCL file for remote execution.
Description
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
Exploits (3)
This Metasploit module exploits CVE-2015-2509 by crafting a malicious .mcl file that triggers a UNC path download, leading to arbitrary code execution via Windows Media Center. The exploit generates a payload executable and embeds it in the MCL file for remote execution.
This exploit generates a malicious Music.mcl file that, when opened by Windows Media Center, executes an arbitrary command (e.g., calc.exe) due to improper XML parsing. It leverages CVE-2015-2509 to achieve remote code execution.
This Metasploit module exploits CVE-2015-2509 in Windows Media Center by crafting a malicious .mcl file that references a UNC path to execute a remote payload. The exploit generates a payload executable and an MCL file to trigger automatic remote file execution.