CVE-2015-6132
Microsoft Windows - Local Privilege Escalation via Library Loading
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-6132. PoCs published by Google Security Research, hexx0r.
AI-analyzed exploit summary This exploit demonstrates a DLL planting attack in Microsoft Office 2010/2013 by embedding a crafted OLE object that triggers a delay-loaded DLL (mqrt.dll) to be loaded from the current directory, leading to arbitrary code execution.
Description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Exploits (3)
This exploit demonstrates a DLL planting attack in Microsoft Office 2010/2013 by embedding a crafted OLE object that triggers a delay-loaded DLL (mqrt.dll) to be loaded from the current directory, leading to arbitrary code execution.
This repository provides a proof-of-concept for CVE-2015-6132, a Microsoft Office / COM Object DLL Planting vulnerability. The PoC involves an RTF file and a malicious DLL (mqrt.dll) that executes arbitrary code (e.g., launching calc.exe) when placed in the same directory.
This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a crafted PPSX file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.