module

Windows Escalate Task Scheduler XML Privilege Escalation

Try Surface Command
Back to search
Disclosed
2010-09-13
Created
2018-05-30

Description

This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
When processing task files, the Windows Task Scheduler only uses a CRC32
checksum to validate that the file has not been tampered with. Also, In a default
configuration, normal users can read and write the task files that they have
created. By modifying the task file and creating a CRC32 collision, an attacker
can execute arbitrary commands with SYSTEM privileges.

NOTE: Thanks to webDEViL for the information about disable/enable.

Author

jduck jduck@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/local/ms10_092_schelevator
    msf exploit(ms10_092_schelevator) > show targets
        ...targets...
    msf exploit(ms10_092_schelevator) > set TARGET < target-id >
    msf exploit(ms10_092_schelevator) > show options
        ...show and set options...
    msf exploit(ms10_092_schelevator) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today