{"vulnerability": "CVE-2010-2743", "sightings": [{"uuid": "f3f14d49-9e25-4da0-8546-d0eda34f27fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:39.000000Z"}, {"uuid": "b11add45-8bd6-47e2-9cca-002903c0287d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:48.000000Z"}, {"uuid": "f9b5ffec-37b8-48c3-aaa4-9e73f7e8f82b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "ac004b51-3ec7-4797-94c8-acd9a184f280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-2743", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/15985", "content": "", "creation_timestamp": "2011-01-13T00:00:00.000000Z"}, {"uuid": "16172bcc-73e6-4261-8891-5d613ddbe8da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mtb5v7fisd2i", "content": "[RSS] Remember CVE-2010-2743 ?\n\n\n blog.projectnightcrawler.dev -> \n\n\nOriginal->", "creation_timestamp": "2026-08-17T07:17:27.905074Z"}, {"uuid": "6db2072c-9fca-49d9-b203-71c58bccb00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Ruben Santamarta\", \"jduck \"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": false, \"default_credential\": false, \"description\": \"This module exploits the keyboard layout vulnerability exploited by Stuxnet. When\\n          processing specially crafted keyboard layout files (DLLs), the Windows kernel fails\\n          to validate that an array index is within the bounds of the array. By loading\\n          a specially crafted keyboard layout, an attacker can execute code in Ring 0.\", \"disclosure_date\": \"2010-10-12\", \"fullname\": \"post/windows/escalate/ms10_073_kbdlayout\", \"is_install_path\": true, \"mod_time\": \"2025-05-09 10:51:17 +0000\", \"name\": \"Windows Escalate NtUserLoadKeyboardLayoutEx Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/post/windows/escalate/ms10_073_kbdlayout.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/escalate/ms10_073_kbdlayout\", \"references\": [\"OSVDB-68552\", \"CVE-2010-2743\", \"MSB-MS10-073\", \"URL-https://web.archive.org/web/20160308010201/http://www.reversemode.com/index.php?option=com_content&task=view&id=71&Itemid=1\", \"EDB-15985\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.699782Z"}, {"uuid": "2b6acf9b-0f2a-4650-934e-e163aeef450f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://gist.github.com/mziqudhd92/324eace1c3f00282242b870925f8a9ce", "content": "1. **Historical Background**\n   - Stuxnet's win32k exploit (CVE-2010-2743) and Microsoft's patch evolution.\n   - Shift from file-mapping to `ZwReadFile` and trusted directory enforcement.\n   - **2026 still contains vulnerability**\n\n2. **Trusted Directory Bypass via ADS**\n   - How ADS evades MS12-034's path checks.\n   - Why `System32\\Tasks` is ideal: writable by standard users, trusted location.\n   - Code snippet to create malicious ADS:  \n     `fsutil file createnew C:\\Windows\\System32\\Tasks:t.kbd 1024`\n\n3. **The NTFS Ownership/DACL Problem**\n   - Analysis of SYSTEM-owned ADS creation and inherited DACL (write-only access).\n   - Why `NtUserLoadKeyboardEx` fails without read access.\n\n4. **Exploiting the NTFS Bug**\n   - Technical deep-dive into the NTFS flaw allowing read-access recovery:\n     - Probable causes: Object attribute inheritance bugs or security descriptor miscalculation.\n     - Step-by-step method to regain access (undisclosed; researchers should reverse-engineer NTFS handle operations).\n   - Weaponization: Combining read-access recovery with malicious `.kbd`to trigger kernel corruption.\n\n5. **Defensive Implications**\n   - Detection: Monitor ADS creation in `System32\\Tasks` and unexpected `.kbd` loads.\n   - Mitigation: Restrict ADS in trusted directories via Group Policy; audit DACL inheritance.\n\n6. **Research Pathways**\n   - **Reverse Engineering Targets**:\n   - see comment #1\n\n#### **Responsible Disclosure Advice**\n- **Before publication**: Report NTFS bug to Microsoft via MSRC if confirmed.\n- **Article caution**: Describe techniques without PoC code until patched.\n\n**Next Steps for Researchers**:  \n1. Reproduce ADS creation in `System32\\Tasks` and capture DACL behavior.\n2. Trace `NtUserLoadKeyboardEx` with kernel debugger to identify read-access failure points.\n3. Hunt for similar overlooked trusted directories (e.g., `System32\\spool\\drivers`).\n4. Read the comment below for start.", "creation_timestamp": "2026-09-10T08:20:02.039014Z"}]}