{"vulnerability": "CVE-2010-2743", "sightings": [{"uuid": "f3f14d49-9e25-4da0-8546-d0eda34f27fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:39.000000Z"}, {"uuid": "b11add45-8bd6-47e2-9cca-002903c0287d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:48.000000Z"}, {"uuid": "f9b5ffec-37b8-48c3-aaa4-9e73f7e8f82b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "ac004b51-3ec7-4797-94c8-acd9a184f280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-2743", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/15985", "content": "", "creation_timestamp": "2011-01-13T00:00:00.000000Z"}, {"uuid": "16172bcc-73e6-4261-8891-5d613ddbe8da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mtb5v7fisd2i", "content": "[RSS] Remember CVE-2010-2743 ?\n\n\n blog.projectnightcrawler.dev -> \n\n\nOriginal->", "creation_timestamp": "2026-08-17T07:17:27.905074Z"}, {"uuid": "2b6acf9b-0f2a-4650-934e-e163aeef450f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-2743", "type": "seen", "source": "https://gist.github.com/mziqudhd92/324eace1c3f00282242b870925f8a9ce", "content": "1. **Historical Background**\n   - Stuxnet's win32k exploit (CVE-2010-2743) and Microsoft's patch evolution.\n   - Shift from file-mapping to `ZwReadFile` and trusted directory enforcement.\n   - **2026 still contains vulnerability**\n\n2. **Trusted Directory Bypass via ADS**\n   - How ADS evades MS12-034's path checks.\n   - Why `System32\\Tasks` is ideal: writable by standard users, trusted location.\n   - Code snippet to create malicious ADS:  \n     `fsutil file createnew C:\\Windows\\System32\\Tasks:t.kbd 1024`\n\n3. **The NTFS Ownership/DACL Problem**\n   - Analysis of SYSTEM-owned ADS creation and inherited DACL (write-only access).\n   - Why `NtUserLoadKeyboardEx` fails without read access.\n\n4. **Exploiting the NTFS Bug**\n   - Technical deep-dive into the NTFS flaw allowing read-access recovery:\n     - Probable causes: Object attribute inheritance bugs or security descriptor miscalculation.\n     - Step-by-step method to regain access (undisclosed; researchers should reverse-engineer NTFS handle operations).\n   - Weaponization: Combining read-access recovery with malicious `.kbd`to trigger kernel corruption.\n\n5. **Defensive Implications**\n   - Detection: Monitor ADS creation in `System32\\Tasks` and unexpected `.kbd` loads.\n   - Mitigation: Restrict ADS in trusted directories via Group Policy; audit DACL inheritance.\n\n6. **Research Pathways**\n   - **Reverse Engineering Targets**:\n   - see comment #1\n\n#### **Responsible Disclosure Advice**\n- **Before publication**: Report NTFS bug to Microsoft via MSRC if confirmed.\n- **Article caution**: Describe techniques without PoC code until patched.\n\n**Next Steps for Researchers**:  \n1. Reproduce ADS creation in `System32\\Tasks` and capture DACL behavior.\n2. Trace `NtUserLoadKeyboardEx` with kernel debugger to identify read-access failure points.\n3. Hunt for similar overlooked trusted directories (e.g., `System32\\spool\\drivers`).\n4. Read the comment below for start.", "creation_timestamp": "2026-09-10T08:20:02.039014Z"}]}