CVE-2016-0040

This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.exe (CVE-2016-0040) to achieve local privilege escalation on Windows 7 SP0/SP1 x64 systems. It injects a reflective DLL into a process (e.g., notepad.exe) to trigger the vulnerability and execute a payload with elevated privileges.

The repository provides a reference to a PoC for CVE-2016-0040, which involves an uninitialized pointer vulnerability in the Windows kernel allowing arbitrary data writes to arbitrary addresses. The README directs users to a blog post for technical details but does not include actual exploit code.

This repository contains a functional exploit for CVE-2016-0040, a Windows kernel vulnerability in the WMIDataDevice driver. The exploit leverages bitmap manipulation and memory corruption to achieve privilege escalation by targeting the pvScan0 structure in kernel memory.

This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl to achieve local privilege escalation on vulnerable Windows 7 SP0/SP1 x64 systems. It reflectively injects a DLL payload to trigger the vulnerability and elevate privileges.