Analysis of CVE - 2014 - 4113 (Windows privilege Escalation Vulnerability)

[Aerosol]

Here we will be looking a kernel level privilege escalation vulnerability

CVE

-

2014

-

4113

. The vulnerability

is exploited by creating tagWND structure at NULL page (0x000

00000).

We’ll see

here why

control is

transferred to

the shellcode

and the reason the

malicious

tagWND structure is th

e crafted the way it is.

User

-

Mode Code

The exe first tries to determine the OS it is running on and stores the following data in the vari

able

based on the OS version and build:

• Windows Xp S
  
• p2
  
• 0c8
  
• Windows Xp S
  
• p1
  
• 12c
  
• Windows Xp S
  
• p3
  
• 0d8
  
• Windows Server 2008
  
• 0e0
  
• windows 7
  
• / Windows Server 2008 R2
  
• 0f8
  

Read more: http://www.exploit-db.com/wp-content/themes/exploit/docs/35937.pdf