Windows Escalate Task Scheduler XML Privilege Escalation

This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet. When processing task files, the Windows Task Scheduler only uses a CRC32 checksum to validate that the file has not been tampered with. Also, In a default configuration, normal users can read and write the task files that they have created. By modifying the task file and creating a CRC32 collision, an attacker can execute arbitrary commands with SYSTEM privileges. NOTE: Thanks to webDEViL for the information about disable/enable.

Search Other Modules

Rank

• Normal

Authors

• jduck < jduck [at] metasploit.com >

Vulnerability References

• OSVDB-68518
• CVE-2010-3338
• BID-44357
• MSB-MS10-092
• EDB-15589

Development

• Source Code
• History

Similar Modules

• post/windows/escalate/bypassuac
• post/windows/escalate/droplnk
• post/windows/escalate/getsystem
• post/windows/escalate/ms10_073_kbdlayout
• post/windows/escalate/net_runtime_modify
• post/windows/escalate/screen_unlock
• post/windows/escalate/service_permissions

Usage Information

Module Options