### CVE-2015-0057

#### Describe

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."


#### ImpactVersion

| Product             | CPU Architecture | Version | Update | Tested             |
| ------------------- | ---------------- | ------- | ------ | ------------------ |
| Windows 7           |                  |         | SP1    | &#10004; |
| Windows 8           |                  |         |        |                    |
| Windows 8.1         |                  |         |        |                    |
| Windows Rt          |                  |         |        |                    |
| Windows Rt 8.1      |                  |         |        |                    |
| Windows Server 2003 |                  |         | SP2    |                    |
| Windows Server 2008 |                  |         | SP2    |                    |
| Windows Server 2008 |                  | R2      | SP1    | &#10004; |
| Windows Server 2012 |                  |         |        |                    |
| Windows Server 2012 |                  | R2      |        |                    |
| Windows Vista       |                  |         | SP2    |                    |

#### Utilization

There are currently two source code

1. **CVE-2015-0057_win8.1**Source code for Windows 8.1 below the folder, feasibility is not tested
2. [exploit-db](https://www.exploit-db.com/exploits/37098)Download the source code did not test

The test uses the compiled EXP `CVE-2015-0057_x86` and `CVE-2015-0057_x64` found on the web,可With the success of Windows7 / 2008, it will add user accounts `k8team$` passwd `K8TeAm520!@#`

Test Windows 7 SP1 X86

![2](https://raw.github.com/Ascotbe/Image/master/Kernelhub/CVE-2015-0057_win7_sp1_x86.gif)

#### Analyze
- https://xz.aliyun.com/t/4549
- https://paper.seebug.org/1439/
- https://www.anquanke.com/post/id/163973
- https://blog.csdn.net/qq_35713009/article/details/102921859