CVE-2015-6128
Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1 - Privilege Escalation via Library Loading
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2015-6128. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit demonstrates a DLL planting attack in Microsoft Office via a crafted OLE object. By modifying the CLSID in a document, an attacker can force the loading of a malicious DLL (elsext.dll) from the current directory, achieving arbitrary code execution.
Description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Exploits (2)
This exploit demonstrates a DLL planting attack in Microsoft Office via a crafted OLE object. By modifying the CLSID in a document, an attacker can force the loading of a malicious DLL (elsext.dll) from the current directory, achieving arbitrary code execution.
This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a PPSX file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.