CVE-2019-1388 Privilege Escalation
CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7.
CVE-2019-1388: Windows UAC Privilege Escalation Lab
An educational cybersecurity lab and technical analysis documenting CVE-2019-1388—a local privilege escalation vulnerability in the Windows Certificate Dialog allowing a low-privileged user to gain NT AUTHORITY\SYSTEM access.
Technical Overview
- CVE ID: CVE-2019-1388
- Vulnerability Type: Local Privilege Escalation / UAC Bypass
- Target Environment: Windows 7 Ultimate (VirtualBox)
- Impact: Complete system compromise (Confidentiality, Integrity, Availability)
- Root Cause: Improper privilege enforcement in the Windows Certificate Dialog when spawning web browser processes during publisher verification.
Lab Environment & Prerequisites
- Hypervisor: VirtualBox
- Guest OS: Windows 7 Ultimate (Configured with standard
Guest and Admin accounts)
- Tools: Target binary (
hhupd.exe), Internet Explorer, Windows Explorer, cmd.exe
Step-by-Step Exploitation Walkthrough
{/* Reason: Demonstrates the sequential steps required to trigger and exploit the UAC privilege escalation vulnerability safely. */}
Log into the Windows 7 Virtual Machine as the **Guest** user. Open the Command Prompt and verify low privilege status:
```cmd
whoami
```
Download the targeted executable (`hhupd.exe`). Right-click the binary, select **Properties**, and uncheck the web marker (Unblock). Right-click again and select **Run as Administrator** to trigger the UAC prompt.
On the UAC prompt, click **Show details** $\rightarrow$ **Show information about this publisher's certificate**. In the certificate viewer, click the **VeriSign** hyperlink to launch Internet Explorer running under `NT AUTHORITY\SYSTEM` privileges.
Dismiss the UAC prompt. In the high-privilege browser window, select **File** $\rightarrow$ **Save As...**. Navigate to `C:\Windows\System32`, change the file type filter to *All Files*, locate `cmd.exe`, right-click it, and select **Open**.
In the newly spawned terminal, verify elevated SYSTEM rights and access restricted administrator directories:
```cmd
whoami
cd C:\Users\Admin\Desktop
dir
copy image.jpg C:\Users\Guest\Desktop
```
- Patching: Apply Microsoft's November 2019 Security Update (KB4524445 or relevant OS cumulative update).
- Least Privilege: Ensure User Account Control (UAC) enforcement policies strictly validate certificate link handling routines.
tafloh/cve-2019-1388-privilege-escalation--2021-
