When your talent

When you can't support your ambition

Then you should calm down and study

table of Contents

0x01 Windows Quick Find EXP

0x02 Linux Quick Find EXP

0x03 MSF detection system patch

0x04 GetWindowsKernelExploitsKB query patch

0x01 and 0x02 from Master Micropoor's article

Article link: https://github.com/Micropoor/Micro8

0x01 Windows Quick Find EXP

https://docs.microsoft.com/zh-cn/security-updates/securitybulletins/2017/ms17-023

For example, several commonly used EXP

KB2592799
KB3000061
KB2592799
… ...

Quickly find the patch, it is convenient for us to quickly find the patch missing by the enterprise or quickly find the corresponding EXP for privilege escalation

There are two ways: one is to find EXP with its own command, and the other is to use script to run.

Find EXP from the command line:

systeminfo>micropoor.txt&(for %i in ( KB977165 KB2160329 KB2503665 KB2592799 KB2707511 KB2829361 KB2850851 KB3000061 KB3045171 KB3077657 KB3079904 KB3134228 KB3143141 KB3141780 ) do @type micropoor.txt|@find /i  "%i"|| @echo %i you can fuck)&del /f /q /a micropoor.txt

1. Execute the systeminfo command and write the content to micropoor.txt

Second, 1. is a loop, a formal variable% i, traverse from (exp1, exp2), and display the contents of micropoor.txt

2. 2. / i (don't care about the case) Find the existence of exp in the displayed micropoor.txt

2. 3. If the exp does not exist in micropoor.txt, execute it, indicating that there is no exp and can be used, then output exp you can fuck, if it exists in micropoor.txt, do not execute this command

Third, forcefully delete the created micropoor.txt file (without leaving traces)

Note: It needs to be executed in the writable directory. The micrpoor.txt needs to be generated temporarily. Please add or delete the above patch numbers according to the environment.

Under Windows 10:

Under windows 7 environment:

I executed it locally in the virtual machine, directly with Administrator permissions. Normally, after we get WebShell, the permissions are generally ordinary user permissions. At this time, we need to execute under a directory with execution permissions, similar to a temporary directory (Tmp) directory and other writable directories, such as: c: \ temp

We can see what permissions are currently available first:

EXP Note:

MS17-017 [KB4013081] [GDI Palette Objects Local Privilege Escalation] (windows 7/8) 

CVE-2017-8464 [LNK Remote Code Execution Vulnerability] (windows 10/8.1/7/2016/2010/2008） 

CVE-2017-0213 [Windows COM Elevation of Privilege Vulnerability] (windows 10/8.1/7/2016/2010/2008) 

MS17-010 [KB4013389] [Windows Kernel Mode Drivers](windows 7/2008/2003/XP) 

MS16-135 [KB3199135] [Windows Kernel Mode Drivers] (2016) 

MS16-111 [KB3186973] [kernel api] (Windows 10 10586 (32/64)/8.1) 

MS16-098 [KB3178466] [Kernel Driver] (Win 8.1) 

MS16-075 [KB3164038] [Hot Potato] (2003/2008/7/8/2012) 

MS16-034 [KB3143145] [Kernel Driver] (2008/7/8/10/2012) 

MS16-032 [KB3143141] [Secondary Logon Handle] (2008/7/8/10/2012) 

MS16-016 [KB3136041] [WebDAV] (2008/Vista/7) 

MS15-097 [KB3089656] [remote code execution] (win8.1/2012) 

MS15-076 [KB3067505] [RPC] (2003/2008/7/8/2012) 

MS15-077 [KB3077657] [ATM] (XP/Vista/Win7/Win8/2000/2003/2008/2012) 

MS15-061 [KB3057839] [Kernel Driver] (2003/2008/7/8/2012) 

MS15-051 [KB3057191] [Windows Kernel Mode Drivers] (2003/2008/7/8/2012) 

MS15-010 [KB3036220] [Kernel Driver] (2003/2008/7/8) 

MS15-015 [KB3031432] [Kernel Driver] (Win7/8/8.1/2012/RT/2012 R2/2008 R2) 

MS15-001 [KB3023266] [Kernel Driver] (2008/2012/7/8) 

MS14-070 [KB2989935] [Kernel Driver] (2003) 

MS14-068 [KB3011780] [Domain Privilege Escalation] (2003/2008/2012/7/8) 

MS14-058 [KB3000061] [Win32k.sys] (2003/2008/2012/7/8) 

MS14-040 [KB2975684] [AFD Driver] (2003/2008/2012/7/8) 

MS14-002 [KB2914368] [NDProxy] (2003/XP) 

MS13-053 [KB2850851] [win32k.sys] (XP/Vista/2003/2008/win 7) 

MS13-046 [KB2840221] [dxgkrnl.sys] (Vista/2003/2008/2012/7) 

MS13-005 [KB2778930] [Kernel Mode Driver] (2003/2008/2012/win7/8) 

MS12-042 [KB2972621] [Service Bus] (2008/2012/win7) 

MS12-020 [KB2671387] [RDP] (2003/2008/7/XP) 

MS11-080 [KB2592799] [AFD.sys] (2003/XP) 

MS11-062 [KB2566454] [NDISTAPI] (2003/XP) 

MS11-046 [KB2503665] [AFD.sys] (2003/2008/7/XP) 

MS11-011 [KB2393802] [kernel Driver] (2003/2008/7/XP/Vista) 

MS10-092 [KB2305420] [Task Scheduler] (2008/7) 

MS10-065 [KB2267960] [FastCGI] (IIS 5.1, 6.0, 7.0, and 7.5) 

MS10-059 [KB982799] [ACL-Churraskito] (2008/7/Vista) 

MS10-048 [KB2160329] [win32k.sys] (XP SP2 & SP3/2003 SP2/Vista SP1 & SP2/2008 Gold & SP2 & R2/Win7) 

MS10-015 [KB977165] [KiTrap0D] (2003/2008/7/XP) 

MS10-012 [KB971468] [SMB Client Trans2 stack overflow] (Windows 7/2008R2) 

MS09-050 [KB975517][Remote Code Execution] (2008/Vista) 

MS09-020 [KB970483] [IIS 6.0] (IIS 5.1 and 6.0) 

MS09-012 [KB959454] [Chimichurri] (Vista/win7/2008/Vista) 

MS08-068 [KB957097] [Remote Code Execution] (2000/XP) 

MS08-067 [KB958644] [Remote Code Execution] (Windows 2000/XP/Server 2003/Vista/Server 2008) 

MS08-066 [] [] (Windows 2000/XP/Server 2003) 

MS08-025 [KB941693] [Win32.sys] (XP/2003/2008/Vista) 

MS06-040 [KB921883] [Remote Code Execution] (2003/xp/2000) 

MS05-039 [KB899588] [PnP Service] (Win 9X/ME/NT/2000/XP/2003) 

MS03-026 [KB823980] [Buffer Overrun In RPC Interface] (/NT/2000/XP/2003)

Published EXP:

https://github.com/SecWiki/windows-kernel-exploits

https://github.com/WindowsExploits/Exploits

https://github.com/AusJock/Privilege-Escalation

0x02 Linux Quick Find EXP

linux-kernel-exploits Elevation of privilege vulnerability collection for Linux platform

Next-generation Linux kernel utilization suggester

CVE-2017-1000367 [Sudo] (Sudo 1.8.6p7 - 1.8.20) 

CVE-2017-1000112 [a memory corruption due to UFO to non-UFO path switch] 

CVE-2017-7494 [Samba Remote execution] (Samba 3.5.0-4.6.4/4.5.10/4.4.14) 

CVE-2017-7308 [a signedness issue in AF_PACKET sockets] (Linux kernel through 4.10.6) 

 CVE-2017-6074 [a double-free in DCCP protocol] (Linux kernel through 4.9.11) 

CVE-2017-5123 ['waitid()'] (Kernel 4.14.0-rc4+) 

CVE-2016-9793 [a signedness issue with SO_SNDBUFFORCE and SO_RCVBUFFORCE socket options] (Linux kernel before 4.8.14) 

CVE-2016-5195 [Dirty cow] (Linux kernel>2.6.22 (released in 2007)) 

CVE-2016-2384 [a double-free in USB MIDI driver] (Linux kernel before 4.5) 

CVE-2016-0728 [pp_key] (3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13,3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6,3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1) 

CVE-2015-7547 [glibc getaddrinfo] (before Glibc 2.9) 

CVE-2015-1328 [overlayfs] (3.13, 3.16.0, 3.19.0) 

CVE-2014-5284 [OSSEC] (2.8) 

CVE-2014-4699 [ptrace] (before 3.15.4) 

CVE-2014-4014 [Local Privilege Escalation] (before 3.14.8) 

CVE-2014-3153 [futex] (3.3.5 ,3.3.4 ,3.3.2 ,3.2.13 ,3.2.9 ,3.2.1 ,3.1.8 ,3.0.5 ,3.0.4 ,3.0.2 ,3.0.1 ,2.6.39 ,2.6.38 ,2.6.37 ,2.6.35 ,2.6.34 ,2.6.33 ,2.6.32 ,2.6.9 ,2.6.8,2.6.7 ,2.6.6 ,2.6.5 ,2.6.4 ,3.2.2 ,3.0.18 ,3.0 ,2.6.8.1) 

CVE-2014-0196 [rawmodePTY] (2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37, 2.6.38, 2.6.39, 3.14, 3.15) 

CVE-2014-0038 [timeoutpwn] (3.4, 3.5, 3.6, 3.7, 3.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1) 

CVE-2013-2094 [perf_swevent] (3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4,3.4.5, 3.4.6, 3.4.8, 3.4.9, 3.5, 3.6, 3.7, 3.8.0, 3.8.1, 3.8.2, 3.8.3,3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9) 

CVE-2013-1858 [clown-newuser] (3.3-3.8) 

CVE-2013-1763 [__sock_diag_rcv_msg] (before 3.8.3) 

CVE-2013-0268 [msr] (2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26,2.6.27, 2.6.27, 2.6.28,2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37,2.6.38, 2.6.39, 3.0.0,3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7.0, 3.7.6) 

CVE-2012-3524 [libdbus] (libdbus 1.5.x and earlier) 

CVE-2012-0056 [memodipper] (2.6.39, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0) 

CVE-2010-4347 [american-sign-language] ( 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9,2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21,2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36) 

CVE-2010-4258 [full-nelson] (2.6.31, 2.6.32, 2.6.35, 2.6.37) 

CVE-2010-4073 [half_nelson] (2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9,2.6.10, 2.6.11, 2.6.12,2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21,2.6.22, 2.6.23, 2.6.24,2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33,2.6.34, 2.6.35, 2.6.36) 

CVE-2010-3904 [rds] (2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36) 

CVE-2010-3437 [pktcdvd] (2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9,2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21,2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36) 

CVE-2010-3301 [ptrace_kmod2] (2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34) 

CVE-2010-3081 [video4linux] (2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12,2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33) 

CVE-2010-2959 [can_bcm] (2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36) 

CVE-2010-1146 [reiserfs] (2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34) 

CVE-2010-0415 [do_pages_move] (2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31) 

CVE-2009-3547 [pipe.c_32bit] (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13,2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25,2.4.26, 2.4.27, 2.4.28,2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37,2.6.15, 2.6.16, 2.6.17,2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26,2.6.27, 2.6.28, 2.6.29,2.6.30, 2.6.31) 

CVE-2009-2698 [udp_sendmsg_32bit] (2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19) 

CVE-2009-2692 [sock_sendpage] (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13,2.4.14, 2.4.15, 2.4.16,2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28,2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37,2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12,2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30) 

CVE-2009-2692 [sock_sendpage2] (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25,2.4.26, 2.4.27, 2.4.28,2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.0, 2.6.1, 2.6.2,2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15,2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24,2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30) 

CVE-2009-1337 [exit_notify] (2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29) 

CVE-2009-1185 [udev] (2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29) 

CVE-2008-4210 [ftrex] (2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19,2.6.20, 2.6.21, 2.6.22) 

CVE-2008-0600 [vmsplice2] (2.6.23, 2.6.24) 

CVE-2008-0600 [vmsplice1] (2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.24.1) 

CVE-2006-3626 [h00lyshit] (2.6.8, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16) 

CVE-2006-2451 [raptor_prctl] (2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17) 

CVE-2005-0736 [krad3] (2.6.5, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11) 

CVE-2005-1263 [binfmt_elf.c] (Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4) 48. CVE-2004-1235 [elflbl] (2.4.29) 

CVE-N/A [caps_to_root] (2.6.34, 2.6.35, 2.6.36) 

CVE-2004-0077 [mremap_pte] (2.4.20, 2.2.24, 2.4.25, 2.4.26, 2.4.27)

Public EXP:

https://github.com/SecWiki/linux-kernel-exploits

https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack/

https://github.com/xairy/kernel-exploits

0x03 MSF detection system patch

use post/windows/gather/enum_patches  配置对应的模块

show options   查看有哪些需要配置的参数

sessions x     配置要配置的sessions会话值

# 假如不知道自己刚刚获取的sessions 值是多少的话，可以通过命令：sessions 查看
# 配置好对应的参数，运行

run   执行

# 如果检测失败的话，可能是进程被占用
# 报错提示：Known bug in WMI query，try migrating to another process
# 此时，我们迁移到另外一个进程尝试如下命令，迁移到另外一个进程

# 进入sessions 会话，将马儿迁移到别的进程上
sessions x

getpid            查看当前所在进程  

ps                查看所有进程
 
migrate 1010      移植进程 1010

# 然后返回开头的配置模块的设置再次试试，就能解决问题

0x04 GetWindowsKernelExploitsKB query patch

GetWindowsKernelExploitsKB

Although we live in a gutter, there are still people looking up at the stars!

Bro '

Published 194 original articles · 120 praises · 130,000 visits +

Private letter concerns

[Intranet penetration articles] Window Quick Search EXP [+ Expansion articles]

0x01 Windows Quick Find EXP

0x02 Linux Quick Find EXP

0x03 MSF detection system patch

0x04 GetWindowsKernelExploitsKB query patch

Guess you like