cve-2014-4113 Windows kill local power 0day

This 0day discovery is very interesting, is the foreigner CrowdStrike found, by the Foreigner Monitoring Program found show from Webshell use Win64.exe to elevate permissions.

Original address: http://blog.crowdstrike.com/ crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/

The foreigner also said that the attack code was written very well, with a success rate of 100%.

The Win64.exe tool is only uploaded when needed and then immediately deleted.

The Win64.exe compile time is May 3, 2014, and the vulnerability has been exploited for at least 5 months.

Another interesting thing about this tool is that there is a string inside that is "Woqunimalegebi" this light.

A look is the attack code written by the people of the ROC.

The vulnerability affects all Windows x64, including Windows 7 and Windows Server R2 and the following versions.

Microsoft has released security bulletins and Patches ms14-058

Http://pan.baidu.com/s/1dD7vpxn

cve-2014-4113 Windows kill local power 0day