关联漏洞
标题：
Microsoft Win32k 特权提升漏洞
(CVE-2016-3309)
描述：Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。kernel-mode drivers是其中的一个内核驱动管理软件。Graphics是其中的一个图形驱动器组件。 Microsoft Windows中的kernel-mode驱动程序存在特权提升漏洞，该漏洞源于程序没有正确处理内存中的对象。本地攻击者可利用该漏洞在内核模式下执行任意代码。以下版本受到影响：Microsoft Windows Vista SP2，Windows Server 2008 SP2和R2 S
描述
Exploits for the win32kfull!bFill vulnerability on Win10 x64 RS2 using Bitmap or Palette techniques
介绍
## Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 (CVE-2016-3309 Reloaded)
This Github repo contains exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits should work fine on Windows 10 x64 with Creators Update, build 15063.540 (latest version of Win10 before the release of Microsoft's September Updates).
The Visual Studio solution contains three exploits:
- CVE-2016-3309_Reloaded_Bitmaps: Exploit using the Bitmaps technique
- CVE-2016-3309_Reloaded_Palettes: Exploit using the Palettes technique
- CVE-2016-3309_Reloaded_Deadlock: POC exploit showcasing the system deadlock which happens due to improved Handle validation
We also published a [blog post](https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html) which goes into detail about the exploitation of this "wild" Pool-based overflow.
文件快照
[4.0K] /data/pocs/c0ec2cfeaa0e37350f5f25143ce89d28e91061ef
├── [4.0K] CVE-2016-3309_Reloaded_Bitmaps
│ ├── [7.3K] CVE-2016-3309_Reloaded_Bitmaps.vcxproj
│ ├── [ 964] CVE-2016-3309_Reloaded_Bitmaps.vcxproj.filters
│ └── [ 23K] main_bitmaps.cpp
├── [4.0K] CVE-2016-3309_Reloaded_Deadlock
│ ├── [7.3K] CVE-2016-3309_Reloaded_Deadlock.vcxproj
│ ├── [ 965] CVE-2016-3309_Reloaded_Deadlock.vcxproj.filters
│ └── [8.7K] main_deadlock.cpp
├── [4.0K] CVE-2016-3309_Reloaded_Palettes
│ ├── [7.3K] CVE-2016-3309_Reloaded_Palettes.vcxproj
│ ├── [ 965] CVE-2016-3309_Reloaded_Palettes.vcxproj.filters
│ └── [ 21K] main_palettes.cpp
├── [2.9K] CVE-2016-3309_Reloaded.sln
├── [ 50K] CVE-2016-3309_Reloaded.suo
└── [1007] README.md
3 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。