Exploitation Summary
CVE-2016-0040 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022.
EIP tracks 4 public exploits from researchers including Metasploit, Rootkitsmm-zz, de7ec7ed, including a Metasploit module exploits/windows/local/ms16_014_wmi_recv_notif.
AI-analyzed exploit summary This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.exe (CVE-2016-0040) to achieve local privilege escalation on Windows 7 SP0/SP1 x64 systems. It injects a reflective DLL into a process (e.g., notepad.exe) to trigger the vulnerability and execute a payload with elevated privileges.
Description
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Exploits (4)
This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.exe (CVE-2016-0040) to achieve local privilege escalation on Windows 7 SP0/SP1 x64 systems. It injects a reflective DLL into a process (e.g., notepad.exe) to trigger the vulnerability and execute a payload with elevated privileges.
The repository provides a reference to a PoC for CVE-2016-0040, which involves an uninitialized pointer vulnerability in the Windows kernel allowing arbitrary data writes to arbitrary addresses. The README directs users to a blog post for technical details but does not include actual exploit code.
This repository contains a functional exploit for CVE-2016-0040, a Windows kernel vulnerability in the WMIDataDevice driver. The exploit leverages bitmap manipulation and memory corruption to achieve privilege escalation by targeting the pvScan0 structure in kernel memory.
This Metasploit module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl to achieve local privilege escalation on vulnerable Windows 7 SP0/SP1 x64 systems. It reflectively injects a DLL payload to trigger the vulnerability and elevate privileges.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H