2.2 KiB
2.2 KiB
CVE-2020-0668
描述
Windows内核处理内存中对象的方式存在权限漏洞的提升
影响版本
| Product | CPU Architecture | Version | Update | Tested |
|---|---|---|---|---|
| Windows 10 | x64/x86/ARM64 | 1909 | ||
| Windows 10 | x64/x86/ARM64 | 1903 | ||
| Windows 10 | x64/x86/ARM64 | 1809 | ||
| Windows 10 | x64/x86/ARM64 | 1803 | ||
| Windows 10 | x64/x86/ARM64 | 1709 | ✔ | |
| Windows 10 | x64/x86 | 1607 | ||
| Windows 10 | x64/x86 | |||
| Windows 8.1 | x64/x86 | |||
| Windows RT 8.1 | ||||
| Windows 7 | x64/x86 | SP1 | ||
| Windows Server 2019 | ||||
| Windows Server 2016 | ||||
| Windows Server 2012 | R2 | |||
| Windows Server 2012 | ||||
| Windows Server 2008 | x64/x86 | SP2 | ||
| Windows Server 2008 | x64 | R2 | SP1 | |
| Windows Server | 1909 | |||
| Windows Server | 1903 | |||
| Windows Server | 1803 |
修复补丁
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0668
利用方式
编译环境
- VS2019（.NET Framework 4.7.2）Any CPU Debug
该EXP是使用提权进行文件迁移操作，如果想使用cmd需要自己修改代码，测试机器Windows 10 1709 X64，动图中是把test.dll移动到 C:\Windows\System32目录下，test.dll可以是任意文件。使用exe时需要把NtApiDotNet.dll文件放到同级目录
Use https://github.com/itm4n/UsoDllLoader (Windows >= 1903) OR https://github.com/xct/diaghub (Windows < 1903) for privilege escalation.
分析文章
- https://www.anquanke.com/post/id/199011
- https://www.freebuf.com/vuls/227557.html
- https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/