### CVE-2015-0003

#### Describe

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

#### ImpactVersion

| Product             | CPU Architecture | Version | Update | Tested             |
| ------------------- | ---------------- | ------- | ------ | ------------------ |
| Windows 7           |                  |         | SP1    | &#10004; |
| Windows 8           |                  |         |        |                    |
| Windows 8.1         |                  |         |        |                    |
| Windows Rt          |                  |         |        |                    |
| Windows Rt 8.1      |                  |         |        |                    |
| Windows Server 2003 |                  |         | SP2    |                    |
| Windows Server 2008 |                  |         | SP2    |                    |
| Windows Server 2008 |                  | R2      | SP1    | &#10004; |
| Windows Server 2012 |                  |         |        |                    |
| Windows Server 2012 |                  | R2      |        |                    |
| Windows Vista       |                  |         | SP2    |                    |

#### Utilization

> X86 machine utilization

CompilerEnvironment

- VS2019 （V120_xp）X86 Release

Use Windows 7 SP1 X86 as a demonstration

![10](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win7_x86.gif)

> X64 utilization

CompilerEnvironment

- VS2019 （V142）X64 Release

Testing with Windows Server 2008 R2 SP1 X64

![11](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0003_win2008_x64.gif)

#### Analyze
- https://www.shuzhiduo.com/A/Vx5M1WrL5N/
- https://www.cnblogs.com/flycat-2016/p/5452929.html
- https://www.fireeye.com/blog/threat-research/2015/07/dyre_banking_trojan.html