Loading vulnerability…
A local elevation-of-privilege vulnerability in the Windows Win32k kernel component arises from improper handling of objects in memory in the NtUserSetImeInfoEx code path, specifically insufficient validation of a data pointer in the SetImeInfoEx subroutine. On affected systems, this can lead to a NULL pointer dereference that is exploitable for an arbitrary kernel-memory write. Public technical analysis describes an exploitation scenario in which an attacker manipulates window-station state so an internal pointer becomes NULL, then leverages controlled data at the NULL page to redirect a kernel write to an attacker-chosen address. This vulnerability affects Windows 7 and Windows Server 2008/2008 R2 class systems and has been used as a post-compromise privilege-escalation primitive by multiple malware families and exploit chains to obtain SYSTEM privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a local privilege escalation exploit for CVE-2018-8120, targeting multiple versions of Microsoft Windows (including Windows 7, Windows Server 2008, Windows XP, and Windows Server 2003, both x86 and x64). The exploit is implemented in C++ (Source.cpp) with supporting shellcode in assembly (shellcode.asm). The Visual Studio project files (.sln, .vcxproj, .filters) are provided for building the exploit. The exploit works by abusing a vulnerability in the Windows kernel to overwrite the current process token with the SYSTEM token, then spawns a new process (with a user-supplied command) as SYSTEM. The README provides usage instructions and notes on compilation. The exploit is operational and provides full SYSTEM privileges on vulnerable systems. No network endpoints are involved; the attack vector is purely local. The only fingerprintable endpoint is the use of the 'WinSta0\Default' desktop for the spawned process.
This repository contains an operational local privilege escalation exploit for CVE-2018-8120, a Windows kernel vulnerability affecting Windows 7 x86. The exploit is implemented in C++ (exploit.cpp) and is built using a Visual Studio project. The exploit leverages a NULL pointer dereference in the SetImeInfoEx function of win32k.sys, allowing an attacker to perform an arbitrary write of 0x15c bytes to a chosen address in kernel memory. The exploit uses this primitive to overwrite entries in the Global Descriptor Table (GDT), installing a call gate that enables execution of attacker-controlled code in ring0 (kernel mode). The payload then steals the SYSTEM process token to escalate privileges and spawns a SYSTEM shell. The repository includes build files, logs, and a detailed markdown file (CVE-2018-8120.md) explaining the vulnerability and exploitation technique. The exploit targets unpatched Windows 7 x86 systems and requires local access to execute.
This repository contains a local privilege escalation exploit for CVE-2018-8120, targeting Microsoft Windows 7 SP1 x86 systems. The exploit is implemented in C/C++ (main.cpp) and leverages a vulnerability in the Windows kernel to escalate privileges from a normal user to SYSTEM. The code includes detailed manipulation of kernel structures and uses Windows API calls to interact with system internals. Upon successful exploitation, the code spawns a new command shell (cmd.exe) running as SYSTEM, providing the attacker with full administrative access. The README provides a reference to a detailed analysis and a demonstration GIF. No network endpoints are present; the exploit is purely local. The structure is straightforward, with the main exploit logic in main.cpp and a README for documentation.
This repository contains a local privilege escalation (LPE) exploit for CVE-2018-8120, a vulnerability in Microsoft Windows (Win7, Win2008, and related x32/x64 versions). The exploit is implemented in C++ (Source.cpp) with supporting shellcode in assembly (shellcode.asm). The exploit works by manipulating kernel memory structures to steal the SYSTEM process token and assign it to the current process, then launches an arbitrary command as SYSTEM. The exploit is operational and supports both 32-bit and 64-bit Windows targets. The README provides usage instructions, indicating the exploit is invoked as a command-line tool with the desired command to run as SYSTEM. The project is structured as a Visual Studio solution with appropriate project files for building the exploit. No network endpoints are present; the attack vector is purely local. The only fingerprintable endpoint is the Windows desktop 'WinSta0\Default', used when spawning the SYSTEM process. The exploit is not part of a framework and is a standalone operational exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows privilege escalation vulnerability whose public proof-of-concept exploit is included in the Dharma affiliate toolkit for post-compromise elevation.
A vulnerability included in the PurpleFox exploit chain and explicitly stated as being exploited.
Windows Win32k elevation of privilege vulnerability listed as one of the CVEs used for DirtyMoe installation.
A privilege escalation vulnerability listed as one of the integrated exploits used by Purple Fox during later infection stages.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.