Privilege Escalation in win32k.sys (Improper Message Handling)

This repository contains a single Metasploit module (ms13_005_hwnd_broadcast.rb) that exploits a privilege escalation vulnerability in the Windows kernel (CVE-2013-0008, MS13-005). The exploit leverages improper isolation of window broadcast messages, allowing a process running at Low Integrity to send commands to a process running at Medium Integrity, thereby escalating privileges. The module supports three techniques for delivering the payload: (1) WEB - executes a PowerShell-encoded payload from a remote HTTP server, (2) FILE - drops an executable payload to the filesystem and executes it, and (3) TYPE - executes a PowerShell-encoded payload directly from the command line. The exploit is weaponized, allowing the attacker to run arbitrary code (typically a Meterpreter shell) as a higher-integrity user. The module is designed for use within the Metasploit framework and targets multiple versions of Microsoft Windows. Key endpoints include the temporary file location for dropped payloads and the HTTP server used for payload delivery.