{"metadata": {"vulnerability": "CVE-2010-2743", "count": 21, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 11}}, "data": [{"timestamp": "2010-07-14T00:00:00Z", "date_only": false, "value": "2010-07-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2010-2743", "field": "cveMetadata.dateReserved"}, {"timestamp": "2010-10-12T00:00:00Z", "date_only": false, "value": "2010-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2010-2743", "field": "containers.cna.datePublic"}, {"timestamp": "2010-10-13T00:00:00Z", "date_only": false, "value": "2010-10-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTA-2010-AVI-483", "record": "CERTA-2010-AVI-483", "field": "revisions.0.revision_date"}, {"timestamp": "2011-01-13T00:00:00Z", "date_only": false, "value": "2011-01-13T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/15985", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "ac004b51-3ec7-4797-94c8-acd9a184f280", "url": "https://www.exploit-db.com/exploits/15985"}, {"timestamp": "2011-01-20T20:00:00Z", "date_only": false, "value": "2011-01-20T20:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2010-2743", "field": "cveMetadata.datePublished"}, {"timestamp": "2011-01-20T21:00:00Z", "date_only": false, "value": "2011-01-20T21:00:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GGJQ-QV33-PV47", "record": "GHSA-GGJQ-QV33-PV47", "field": "database_specific.nvd_published_at"}, {"timestamp": "2011-01-20T21:00:00Z", "date_only": false, "value": "2011-01-20T21:00Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2010-2743", "record": "GSD-2010-2743", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2011-01-20T21:00:01.380Z", "date_only": false, "value": "2011-01-20T21:00:01.380", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2010-2743", "record": "FKIE_CVE-2010-2743", "field": "published"}, {"timestamp": "2018-05-29T15:50:33Z", "date_only": false, "value": "2018-05-29T15:50:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "f9b5ffec-37b8-48c3-aaa4-9e73f7e8f82b", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/escalate/ms10_073_kbdlayout.rb"}, {"timestamp": "2018-10-12T19:57:01Z", "date_only": false, "value": "2018-10-12T19:57:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2010-2743", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-05-14T01:31:48Z", "date_only": false, "value": "2022-05-14T01:31:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GGJQ-QV33-PV47", "record": "GHSA-GGJQ-QV33-PV47", "field": "published"}, {"timestamp": "2022-05-14T01:31:48Z", "date_only": false, "value": "2022-05-14T01:31:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GGJQ-QV33-PV47", "record": "GHSA-GGJQ-QV33-PV47", "field": "modified"}, {"timestamp": "2023-12-07T18:38:00Z", "date_only": false, "value": "2023-12-07T18:38Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2010-2743", "record": "GSD-2010-2743", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-12-13T01:21:31.665Z", "date_only": false, "value": "2023-12-13T01:21:31.665983Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2010-2743", "record": "GSD-2010-2743", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-07T02:46:47.217Z", "date_only": false, "value": "2024-08-07T02:46:47.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2010-2743", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-07T02:46:47.217Z", "date_only": false, "value": "2024-08-07T02:46:47.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2010-2743", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-06T03:13:39Z", "date_only": false, "value": "2025-02-06T03:13:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "f3f14d49-9e25-4da0-8546-d0eda34f27fa"}, {"timestamp": "2025-02-23T04:08:48Z", "date_only": false, "value": "2025-02-23T04:08:48.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "b11add45-8bd6-47e2-9cca-002903c0287d"}, {"timestamp": "2026-06-16T23:21:25.287Z", "date_only": false, "value": "2026-06-16T23:21:25.287", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2010-2743", "record": "FKIE_CVE-2010-2743", "field": "lastModified"}, {"timestamp": "2026-08-17T07:17:27.905Z", "date_only": false, "value": "2026-08-17T07:17:27.905074Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mtb5v7fisd2i", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "16172bcc-73e6-4261-8891-5d613ddbe8da", "content": "[RSS] Remember CVE-2010-2743 ?\n\n\n blog.projectnightcrawler.dev -> \n\n\nOriginal->", "url": "https://bsky.app/profile/buherator.bsky.social/post/3mtb5v7fisd2i"}, {"timestamp": "2026-09-10T08:20:02.039Z", "date_only": false, "value": "2026-09-10T08:20:02.039014Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/mziqudhd92/324eace1c3f00282242b870925f8a9ce", "record": "CVE-2010-2743", "field": "creation_timestamp", "uuid": "2b6acf9b-0f2a-4650-934e-e163aeef450f", "content": "1. **Historical Background**\n   - Stuxnet's win32k exploit (CVE-2010-2743) and Microsoft's patch evolution.\n   - Shift from file-mapping to `ZwReadFile` and trusted directory enforcement.\n   - **2026 still contains vulnerability**\n\n2. **Trusted Directory Bypass via ADS**\n   - How ADS evades MS12-034's path checks.\n   - Why `System32\\Tasks` is ideal: writable by standard users, trusted location.\n   - Code snippet to create malicious ADS:  \n     `fsutil file createnew C:\\Windows\\System32\\Tasks:t.kbd 1024`\n\n3. **The NTFS Ownership/DACL Problem**\n   - Analysis of SYSTEM-owned ADS creation and inherited DACL (write-only access).\n   - Why `NtUserLoadKeyboardEx` fails without read access.\n\n4. **Exploiting the NTFS Bug**\n   - Technical deep-dive into the NTFS flaw allowing read-access recovery:\n     - Probable causes: Object attribute inheritance bugs or security descriptor miscalculation.\n     - Step-by-step method to regain access (undisclosed; researchers should reverse-engineer NTFS handle operations).\n   - Weaponization: Combining read-access recovery with malicious `.kbd`to trigger kernel corruption.\n\n5. **Defensive Implications**\n   - Detection: Monitor ADS creation in `System32\\Tasks` and unexpected `.kbd` loads.\n   - Mitigation: Restrict ADS in trusted directories via Group Policy; audit DACL inheritance.\n\n6. **Research Pathways**\n   - **Reverse Engineering Targets**:\n   - see comment #1\n\n#### **Responsible Disclosure Advice**\n- **Before publication**: Report NTFS bug to Microsoft via MSRC if confirmed.\n- **Article caution**: Describe techniques without PoC code until patched.\n\n**Next Steps for Researchers**:  \n1. Reproduce ADS creation in `System32\\Tasks` and capture DACL behavior.\n2. Trace `NtUserLoadKeyboardEx` with kernel debugger to identify read-access failure points.\n3. Hunt for similar overlooked trusted directories (e.g., `System32\\spool\\drivers`).\n4. Read the comment below for start.", "url": "https://gist.github.com/mziqudhd92/324eace1c3f00282242b870925f8a9ce"}]}