CVE-2019-0808
HIGH KEVWindows 7 and Windows Server 2008 - Local Privilege Escalation in Win32k Component
Title source: llmExploitation Summary
CVE-2019-0808 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 7 public exploits from researchers including ze0r, exodusintel, rakesh143, including a Metasploit module exploits/windows/local/ntusermndragover.
AI-analyzed exploit summary This exploit targets a local privilege escalation vulnerability in Microsoft Windows Win32k (CVE-2019-0808). It is designed to elevate privileges on Windows 7 and Server 2008 systems by exploiting a flaw in the Win32k subsystem.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
Exploits (7)
This exploit targets a local privilege escalation vulnerability in Microsoft Windows Win32k (CVE-2019-0808). It is designed to elevate privileges on Windows 7 and Server 2008 systems by exploiting a flaw in the Win32k subsystem.
This repository contains a functional exploit for CVE-2019-0808, a Windows win32k elevation of privilege vulnerability. The exploit leverages a race condition in the win32k!xxxMNDragOver function to achieve arbitrary kernel write primitives, ultimately leading to token stealing for privilege escalation.
This repository contains a functional proof-of-concept exploit for CVE-2019-0808, a Windows win32k elevation of privilege vulnerability. The exploit manipulates menu window messages and hooks to trigger a BSOD, demonstrating the vulnerability's impact.
The repository contains no actual exploit code or technical details, only a link to an external download (PacketStorm). This is a common social engineering tactic to lure researchers into downloading potentially malicious content.
This repository contains a functional exploit for CVE-2019-0808, a Windows local privilege escalation vulnerability in the win32k component. The exploit leverages menu window manipulation and NULL page allocation to achieve arbitrary code execution in kernel mode.
This Metasploit module exploits a NULL pointer dereference vulnerability in the Windows kernel (win32k.sys) via the NtUserMNDragOver system call, leading to local privilege escalation on Windows 7 x86 systems. The exploit reflectively injects a DLL payload to trigger the vulnerability and elevate privileges.
This repository contains documentation and configuration scripts for a collection of Windows kernel exploits, including CVE-2003-0352, CVE-2006-3439, CVE-2008-1084, and others. It includes README files with technical details and a Python script for generating documentation.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H