tafloh/cve-2019-1388-privilege-escalation--2021-CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7.
CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7.
An educational cybersecurity lab and technical analysis documenting CVE-2019-1388—a local privilege escalation vulnerability in the Windows Certificate Dialog allowing a low-privileged user to gain NT AUTHORITY\SYSTEM access.
Guest and Admin accounts)hhupd.exe), Internet Explorer, Windows Explorer, cmd.exeTo exploit the vulnerability, at the start we need to login as a guest user (which has the least privilege). Once logged in, open the command prompt, and enter whoami to ensure we logged in as guest user
Checking for priveledge
After confirmation, open the internet explorer and browse to download the executable (hhupd.exe) from the attacker website ·Once downloaded, right click the executable and in the properties remove the web marker. Therefore, the program can run on all local system. Once it done again right click and select Run as Administrator. It causes the UAC (User Account Control) prompt to display on screen.
Since we do not know the admin password, click show details and then click the link to Show information about this publisher’s certificate. Immediately it shows the certification issuer’s website (Issued by: VeriSign Commercial Software Publishers CA). Click that hyperlink to go to the certificate issuer's website, which will start a browser process that will run as the system.
Close the UAC prompt and return to the main desktop. Now the new browser is visible to us. Even though the link to the page no longer exists, we can still click the page and then save as. At this point, there is an unintentional error. The error message is caused by the fact that the browser is currently running a system.
After dismissing the error, we should select the Windows System 32 folder. Once we have gotten in, we should choose the command dot exe and then open it.
Now we have a command prompt running, type whoami, and press enter to verify the NT authority system (nt authority/system).
In the end we increased the privilege from low to one of the powerful (NT Authority). For example, let us see how the attacker will use this vulnerability to access files from the admin account. We need to go into Users in the C drive by using cd C:\Users. Once we get into the Users folder, we can access the admin account using cd Admin.
After getting into the admin account, we can view files in the admin desktop using cd Desktop and dir (to view files). As we can see, there is an image called image.jpg on Admin’s desktop. We will copy that image file from the admin desktop to the Guest account desktop. The command copy image.jpg C:\Users\Guest\Desktop is used to copy and paste the image from Admin to the Guest account.
For this vulnerability, Microsoft released the full path in November 2019. Because many windows versions have this vulnerability, it is crucial to keep the OS up to date with all the newest patches (ensure that user privilege is enforced correctly in the Windows Certificate Dialog) and security updates. When someone is using the vulnerable version of Windows, make sure to update as soon as possible before someone takes advantage of it. Privilege Escalation is highly risky since it is simple and easier to escalate privilege.