CVE-2017-6008
HIGHSophos HitmanPro < 3.7.20 - Local Privilege Escalation via Malformed IOCTL Call
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2017-6008. PoCs published by cbayet, AntiRootkit1.
AI-analyzed exploit summary The provided text describes a privilege escalation exploit for CVE-2017-6008, targeting a kernel pool buffer overflow in HitmanPro. It references a Quota Process Pointer Overwrite attack and includes links to detailed papers and a Proof of Concept (PoC).
Description
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to escalate privileges via a malformed IOCTL call.
Exploits (3)
The provided text describes a privilege escalation exploit for CVE-2017-6008, targeting a kernel pool buffer overflow in HitmanPro. It references a Quota Process Pointer Overwrite attack and includes links to detailed papers and a Proof of Concept (PoC).
This repository contains a privilege escalation exploit for CVE-2017-6008, targeting a kernel pool buffer overflow in HitmanPro's driver. It includes separate exploits for Windows 7 and Windows 10, leveraging a Quota Process Pointer Overwrite attack to achieve local privilege escalation.
This repository contains functional exploit code for CVE-2017-6008, a kernel pool buffer overflow in HitmanPro's driver (hitmanpro37.sys) leading to local privilege escalation. The exploit leverages a Quota Process Pointer Overwrite attack and includes variants for Windows 7 and Windows 10, with detailed technical references and pool spraying techniques.
References (5)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H