rapid7/metasploit-framework — pull request #2077 by Meatballs1 (2013-07-05 21:42:17+00:00)
Title: [SeeRM #7654] Exploits CVE-2013-0109 NVidia nvsvc Local Privilege Escalation

Similar technique taken to the ppr_flatten technique - dump ready made C into a dll!

I have added a method to the Services post mixin to retrieve the current service status.

If one wished to be clever they could modify this exploit further to target other machines on a domain if the user can authenticate and the firewall doesn't interfere. It could probably also be made as a remote exploit that pivots through a meterpreter session locally (for priv esc) or to an un-firewalled host.