CVE-2018-8453
HIGH KEV RANSOMWAREWindows - Elevation of Privilege in Win32k Component
Title source: llmExploitation Summary
CVE-2018-8453 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 21, 2022, with confirmed use in ransomware campaigns.
EIP tracks 6 public exploits from researchers including Metasploit, ze0r, thepwnrip, including a Metasploit module exploits/windows/local/cve_2018_8453_win32k_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2018-8453, a Win32k privilege escalation vulnerability in Windows. It uploads and executes a precompiled exploit binary to elevate privileges from a local session.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Exploits (6)
This Metasploit module exploits CVE-2018-8453, a Win32k privilege escalation vulnerability in Windows. It uploads and executes a precompiled exploit binary to elevate privileges from a local session.
This repository contains a working exploit for CVE-2018-8453, a Windows kernel vulnerability that allows local privilege escalation (LPE) via a use-after-free in win32k.sys. The exploit uses palette manipulation and pool feng shui techniques to achieve arbitrary read/write in kernel memory.
This repository contains a writeup and presentation materials from leHACK 2019 analyzing CVE-2018-8453, a Use-After-Free (UAF) and double-free vulnerability in the Windows kernel driver win32k.sys. It discusses exploitation techniques, binary diffing, and mitigation bypasses but does not include actual exploit code.
This repository contains a functional exploit for CVE-2018-8453, a Windows kernel privilege escalation vulnerability affecting Windows 8.1 and later. The exploit leverages a use-after-free in win32k.sys via Palette objects to achieve arbitrary kernel read/write and ultimately elevate privileges to SYSTEM.
This Metasploit module exploits CVE-2018-8453, a Win32k privilege escalation vulnerability in Windows. It leverages a memory corruption flaw in the NtUserSetWindowFNID function to escalate privileges from a local user to SYSTEM.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H