# Common Exploits

## Privilege escalation

### KiTrap0D

Allows escalation of privileges on Windows NT/2000/2003/2008/XP/Vista/7

#### msf modules

```
exploit/windows/local/ms10_015_kitrap0d
```

#### Source code

```
https://www.exploit-db.com/exploits/11199
```

### afd.sys exploit

Allows escalation of privilege on Microsoft Windows XP/2003

#### msf module

```
exploit/windows/local/ms11_080_afdjoinleaf
```

#### Source code

```
https://www.exploit-db.com/exploits/18176
```

### Client Copy Image (MS15-51)

#### Source code

```
https://github.com/hfiref0x/CVE-2015-1701/archive/master.zip
```

#### Compiled executables

```
 #x86 exec
 https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/37049-32.exe
 #x64 exec
 https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/37049-64.exe
```

### MS16-032

#### msf modules

```
 exploit/windows/local/ms16_032_secondary_logon_handle_privesc
```

#### Source code

```
https://www.exploit-db.com/exploits/39574/
#powershell
https://www.exploit-db.com/exploits/39719/
https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Invoke-MS16-032.ps1
```

#### Compiled exe

```
https://github.com/Meatballs1/ms16-032
```

### PrintSpoofer

Can escalate privileges on Windows Server 2016, Windows Server 2019 and Windows 10. SeImpersonate user token is required for this exploit. Can be executed remotely by downloading the executable from here:

[https://github.com/dievus/printspoofer](https://github.com/dievus/printspoofer)

```
PrintSpoofer.exe -i -c cmd
```

## Remote code execution

### Net Api exploit

Allows remote code execution on Windows 2000 to XP SP3. Requires an open share

#### msf modules

```
exploit/windows/smb/ms08_067_netapi
```

#### Source code

```
https://www.exploit-db.com/exploits/40279
https://raw.githubusercontent.com/jivoi/pentest/master/exploit_win/ms08-067.py
```

### Eternal Blue

Grants remote code execution on almost any Windows version older than 2000. Requires an open share

#### msf modules

```
auxiliary/admin/smb/ms17_010_command          MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
auxiliary/scanner/smb/smb_ms17_010            MS17-010 SMB RCE Detection
exploit/windows/smb/ms17_010_eternalblue      MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
exploit/windows/smb/ms17_010_eternalblue_win8 MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
exploit/windows/smb/ms17_010_psexec           MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
```

#### Source code

Edit the `smb_pwn` function in the exploit's source code to alter its execution. By default creates a file named pwned.txt in C:\ folder

```
https://www.exploit-db.com/exploits/42315
#mysmb.py library
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42315.py
```
