关联漏洞
描述
SUPERAntiSyware Professional X Trial <= 10.0.1206 Local Privilege Escalation
介绍
# CVE-2020-24955
### **SUPERAntiSpyware Professional X Trial <= 10.0.1206 Local Privilege Escalation**
SUPERAntiSpyware Professional X Trial versions prior to 10.0.1206 are vulnerable to local privilege escalation because it allows unprivileged users to restore quarantined files to a privileged location through a NTFS directory junction.
**Home Page:** https://www.superantispyware.com/
**Proof of Concept**
1. Place a dll payload in an empty folder
2. Scan the payload with the SUPERAntiSpyware Professional X Trial in order to get it detected.
3. Once it is detected and moved to quarantine, create a NTFS directory junction.
4. Restore the payload and reboot the system.
**Full PoC video:** https://www.youtube.com/watch?v=jdcqbev-H5I
**Timeline:**
* **16-07-2020** - Vulnerability discovered
* **16-07-2020** - Notified the vendor via support form (vendor did not response)
* **19-07-2020** - Notified the vendor via email (vendor did not response)
* **25-07-2020** - Vulnerability report to CERT/CC (VRF#20-07-GBPVY)
* **25-08-2020** - Vulnerability Disclosed
* **01-09-2020** - CVE Assigned
**References:**
https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/
文件快照
[4.0K] /data/pocs/4c3609c4ce1db5db7e48856c8896abe7022f2384
└── [1.2K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。