{"uuid": "fcb96ad9-7ff7-4527-8d39-2ead23583ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5065", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms_ndproxy.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Unknown\", \"ryujin\", \"Shahin Ramezany\", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003\\n            SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while\\n            processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used\\n            to access an array unsafely, and the value is used to perform a call, leading to a NULL\\n            pointer dereference which is exploitable on both Windows XP and Windows 2003 systems. This\\n            module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In order to\\n            work the service \\\"Routing and Remote Access\\\" must be running on the target system.\", \"disclosure_date\": \"2013-11-27\", \"fullname\": \"exploit/windows/local/ms_ndproxy\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:46 +0000\", \"name\": \"MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/local/ms_ndproxy.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"windows/local/ms_ndproxy\", \"references\": [\"CVE-2013-5065\", \"MSB-MS14-002\", \"OSVDB-100368\", \"BID-63971\", \"EDB-30014\", \"URL-http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/\", \"URL-http://technet.microsoft.com/en-us/security/advisory/2914486\", \"URL-http://www.secniu.com/blog/?p=53\", \"URL-http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html\", \"URL-http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Automatic\", \"Windows XP SP3\", \"Windows Server 2003 SP2\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:12.039860Z"}