CVE-2018-8120
HIGH KEV RANSOMWAREWindows SetImeInfoEx Win32k NULL Pointer Dereference
Title source: metasploitExploitation Summary
CVE-2018-8120 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 15, 2022, with confirmed use in ransomware campaigns.
EIP tracks 18 public exploits from researchers including Metasploit, rip1s, alpha1ab, including a Metasploit module exploits/windows/local/ms18_8120_win32k_privesc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2018-8120, a Win32k NULL pointer dereference vulnerability in Windows 7 and Server 2008 R2, allowing local privilege escalation to kernel mode. It includes architecture-specific payloads and handles both x86 and x64 targets.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
Exploits (18)
This Metasploit module exploits CVE-2018-8120, a Win32k NULL pointer dereference vulnerability in Windows 7 and Server 2008 R2, allowing local privilege escalation to kernel mode. It includes architecture-specific payloads and handles both x86 and x64 targets.
This is a working proof-of-concept exploit for CVE-2018-8120, a Windows kernel vulnerability in win32k.sys. The exploit leverages a race condition to achieve local privilege escalation (LPE) by manipulating kernel objects and token structures.
This is a working proof-of-concept exploit for CVE-2018-8120, a Windows kernel vulnerability. The code demonstrates a local privilege escalation (LPE) by manipulating kernel structures to elevate privileges to SYSTEM.
This is a working exploit PoC for CVE-2018-8120, a Windows kernel privilege escalation vulnerability. The code leverages a double-free bug to escalate privileges to SYSTEM by manipulating kernel structures and token references.
This PowerShell script exploits CVE-2018-8120, a Windows kernel vulnerability, by manipulating GDI objects to achieve local privilege escalation (LPE). It leverages bitmap handling and memory corruption to escalate privileges from a low-integrity process.
This is a working exploit for CVE-2018-8120, a Windows kernel vulnerability that allows local privilege escalation by manipulating the GDT (Global Descriptor Table) via a call gate. The exploit uses NtUserSetImeInfoEx to trigger the vulnerability and escalate privileges to SYSTEM.
This is a working exploit for CVE-2018-8120, a Windows kernel vulnerability in win32k.sys. The exploit leverages a race condition to achieve local privilege escalation (LPE) by overwriting kernel memory to escalate privileges to SYSTEM.
This repository contains a functional exploit for CVE-2018-8120, a Windows kernel vulnerability. The exploit leverages a double-free condition to achieve local privilege escalation (LPE) by manipulating kernel structures and token stealing.
This repository contains a functional exploit for CVE-2018-8120, a Windows kernel vulnerability in win32k.sys. The exploit leverages bitmap object manipulation to achieve arbitrary read/write in kernel memory, ultimately escalating privileges by overwriting the HalDispatchTable to execute shellcode.
The repository contains only minimal placeholder code with no functional exploit implementation. The files include empty or near-empty C++ files referencing a non-existent 'test.h' header.
This repository contains a functional exploit for CVE-2018-8120, a Windows kernel vulnerability in win32k.sys. The exploit leverages bitmap manipulation and arbitrary read/write primitives to achieve local privilege escalation (LPE) on Windows 7 SP1 systems.
This is a working exploit PoC for CVE-2018-8120, a Windows kernel vulnerability in win32k.sys. The exploit leverages a race condition to achieve local privilege escalation (LPE) by manipulating GDI objects and token stealing.
This Metasploit module exploits CVE-2018-8120, a Win32k NULL pointer dereference vulnerability in Windows 7 and Server 2008 R2, to achieve local privilege escalation. It leverages precompiled exploit binaries to execute arbitrary code in kernel mode.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2018-8120, targeting Windows systems via a vulnerability in the win32k.sys driver. The exploit includes shellcode for token stealing and is tested on multiple Windows 7 and Windows Server 2008 variants.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2018-8120, targeting Windows systems (Win7, Win2008, WinXP, Win2003). The exploit leverages a vulnerability in the Windows kernel to escalate privileges by manipulating the token of the SYSTEM process.
This repository contains documentation and configuration scripts for a collection of Windows kernel exploits, including CVE-2008-1084. It includes README files with technical details and a Python script for generating documentation, but no functional exploit code for CVE-2018-8120.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2018-8120, targeting Windows systems (Win7, Win2008, WinXP, Win2003). The exploit leverages a vulnerability in the Windows kernel to escalate privileges by manipulating the EPROCESS token structure.
References (5)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H