[EXP]CVE-2019-0803 Win32k漏洞提權工具

0x000 漏洞信息
CVE-2019-0803 | Win32k 特權提高漏洞
發佈時間: 2019-04-09
當 Win32k 組件沒法正確處理內存中的對象時，Windows 中存在特權提高漏洞。成功利用此漏洞的攻擊者能夠在內核模式中運行任意代碼。攻擊者可隨後安裝程序；查看、更改或刪除數據；或者建立擁有徹底用戶權限的新賬戶。
若要利用此漏洞，攻擊者首先必須登陸到系統。而後，攻擊者能夠運行一個爲利用此漏洞而經特殊設計的應用程序，從而控制受影響的系統。

0x001 影響版本

Microsoft Windows Server 2019 0
Microsoft Windows Server 2016 0
Microsoft Windows Server 2012 R2 0
Microsoft Windows Server 2012 0
Microsoft Windows Server 2008 R2 for x64-based Systems SP1
Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
Microsoft Windows Server 2008 for x64-based Systems SP2
Microsoft Windows Server 2008 for Itanium-based Systems SP2
Microsoft Windows Server 2008 for 32-bit Systems SP2
Microsoft Windows Server 1803 0
Microsoft Windows Server 1709 0
Microsoft Windows RT 8.1
Microsoft Windows 8.1 for x64-based Systems 0
Microsoft Windows 8.1 for 32-bit Systems 0
Microsoft Windows 7 for x64-based Systems SP1
Microsoft Windows 7 for 32-bit Systems SP1
Microsoft Windows 10 Version 1809 for x64-based Systems 0
Microsoft Windows 10 Version 1809 for ARM64-based Systems 0
Microsoft Windows 10 Version 1809 for 32-bit Systems 0
Microsoft Windows 10 Version 1803 for x64-based Systems 0
Microsoft Windows 10 Version 1803 for ARM64-based Systems 0
Microsoft Windows 10 Version 1803 for 32-bit Systems 0
Microsoft Windows 10 version 1709 for x64-based Systems 0
Microsoft Windows 10 Version 1709 for ARM64-based Systems 0
Microsoft Windows 10 version 1709 for 32-bit Systems 0
Microsoft Windows 10 version 1703 for x64-based Systems 0
Microsoft Windows 10 version 1703 for 32-bit Systems 0
Microsoft Windows 10 Version 1607 for x64-based Systems 0
Microsoft Windows 10 Version 1607 for 32-bit Systems 0
Microsoft Windows 10 for x64-based Systems 0
Microsoft Windows 10 for 32-bit Systems 0

 0x002 EXP用法

Usage:  CVE-2019-0803.exe cmd cmdline

如圖：可能需執行3-4次左右才能提權成功,測試系統爲Win7 X64,其它未測。

0x003 下載

https://github.com/k8gege/K8tools/raw/master/CVE-2019-0803.exe

0x004 補丁

補丁號有不少個，不一樣的系統補丁號不同，有時新的補丁包含舊洞補丁

舊的補丁號會被替換掉，因此每次提權都應該先到官方查看下對應補丁號

不要總是查詢有沒舊的補丁號，而後再去提權，沒有舊的補丁號不表明沒補

https://portal.msrc.microsoft.com/zh-cn/security-guidance/advisory/CVE-2019-0803

0x005 連接

https://www.exploit-db.com/exploits/46920
(steal Security token) https://github.com/mwrlabs/CVE-2016-7255
EDB Note: Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46920.zip

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803
http://packetstormsecurity.com/files/153034/Microsoft-Windows-Win32k-Privilege-Escalation.html