Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation

• Exploit Database
• 128 阅读

• 作者： TomahawkAPT69
  日期： 2019-11-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/47684/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

  ## EDB Note Download: - https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47684-1.exe - https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47684-2.zip     # COMahawk **Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322**   ## Video Demo https://vimeo.com/373051209   ## Usage   ### Compile or Download from Release (https://github.com/apt69/COMahawk/releases)   1. Run COMahawk.exe 2. ??? 3. Hopefully profit   or   1. COMahawk.exe "custom command to run" (ie. COMahawk.exe "net user /add test123 lol123 &") 2. ??? 3. Hopefully profit   ## Concerns **MSDN mentioned that only 1803 to 1903 is vulnerable to CVE-2019-1322. If it doesn't work, maybe it was patched.**   However, it is confirmed that my 1903 does indeed have this bug so maybe it was introduced somewhere inbetween. YMMV.   Also, since you are executing from a service - you most likely cannot spawn any Window hence all command will be "GUI-less". Maybe different session? Idk, it is too late and I am tired haha.   ## Credits: https://twitter.com/leoloobeek for helping me even when he doesn't even have a laptop   https://twitter.com/TomahawkApt69 for being the mental support and motivation   and most of all:   https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/   for discovering and publishing the write up. 100% of the credit goes here.