829
VMScore

CVE-2021-31956

Published: 08/06/2021 Updated: 08/08/2023
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 829
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Windows NTFS Elevation of Privilege Vulnerability

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2008 r2

microsoft windows server 2012 r2

microsoft windows 10 1607

microsoft windows 8.1 -

microsoft windows server 2016 -

microsoft windows 7 -

microsoft windows rt 8.1 -

microsoft windows server 2012 -

microsoft windows 10 -

microsoft windows server 2008 sp2

microsoft windows server 2019 -

microsoft windows 10 1809

microsoft windows 10 1909

microsoft windows 10 2004

microsoft windows server 2016 2004

microsoft windows 10 20h2

microsoft windows server 2016 20h2

microsoft windows 10 21h1

Github Repositories

Win10 20H2 LPE for CVE-2021-31956

CVE-2021-31956 pretty stable exploit on win10 20h2 creates new console window so change that if you don't like oh and more importantly, change the createfilea() path to an actual writeable directory on disk

笔者的在原作者池风水利用工具(以下简称工具)基础上进行二次开发,新增了全自动获取内核调试模块符号的偏移量及配置参数和不同漏洞利用方式优化等功能, 解决了不同Windows版本适配问题,工具包括适配驱动和利用程序两部分组成,实现了在Windows 10 19H1之后任意版本包括满补丁系统上的稳定利用.

引用 这篇文章的目的是介绍一种基于内核态内存的越界写入通用利用技术和相关工具复现 [toc] 简介 笔者的在原作者池风水利用工具(以下简称工具)基础上进行二次开发,新增了全自动获取内核调试模块符号的偏移量及配置参数和不同漏洞利用方式优化等功能, 解决了不同Windows版本适配

C# Utilities for Windows Notification Facility

SharpWnfSuite This is the repository for Windows Notification Facility (WNF) tools Currently, a C# port of the tools in wnfun developed by Alex Ionescu (@aionescu) and Gabrielle Viala (@pwissenlit) has been uploaded When I develop additional tools for Windows Notification Facility, they will be uploaded here Table Of Contents SharpWnfSuite Usage SharpWnfDump SharpWnfNameD

"# CVE-2021-31956" WIP PoC code for CVE-2021-31956 in preparation for OSEE Will improve it further after my OSEE exams and free time A lot of hardcoded offsets need to be changed if it is different on the target system ( but if it is anything similar to 2020 - 2021 builds then no change should be needed Not sure 100%) and you can't exit the program because man

Recent Articles

TOP 10 unattributed APT mysteries
Securelist • Costin Raiu • 07 Oct 2022

Targeted attack attribution is always a tricky thing, and in general, we believe that attribution is best left to law enforcement agencies. The reason is that, while in 90%, it is possible to understand a few things about the attackers, such as their native language or even location, the remaining 10% can lead to embarrassing attribution errors or worse. High-profile actors make every effort to stay undetected inside the victim’s infrastructure and to leave as few traces as they can. They impl...