{"uuid": "4d5c5b83-7e00-4e5c-8f4a-d3143c4a4730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Matteo Memelli\", \"Spencer McIntyre\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a flaw in the AfdJoinLeaf function of the\\n            afd.sys driver to overwrite data in kernel space.  An address\\n            within the HalDispatchTable is overwritten and when triggered\\n            with a call to NtQueryIntervalProfile will execute shellcode.\\n\\n            This module will elevate itself to SYSTEM, then inject the payload\\n            into another SYSTEM process before restoring its own token to\\n            avoid causing system instability.\", \"disclosure_date\": \"2011-11-30\", \"fullname\": \"exploit/windows/local/ms11_080_afdjoinleaf\", \"is_install_path\": true, \"mod_time\": \"2023-05-25 12:45:30 +0000\", \"name\": \"MS11-080 AfdJoinLeaf Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"windows/local/ms11_080_afdjoinleaf\", \"references\": [\"CVE-2011-2005\", \"OSVDB-76232\", \"EDB-18176\", \"MSB-MS11-080\", \"URL-http://www.offensive-security.com/vulndev/ms11-080-voyage-into-ring-zero/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Automatic\", \"Windows XP SP2 / SP3\", \"Windows Server 2003 SP2\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:10.680462Z"}