CVE-2019-1388+CVE-2019-0803复现
CVE-2019-1388+CVE-2019-0803复现
字节脉搏实验室
发布于 2020-04-20 11:14:59
发布于 2020-04-20 11:14:59
作者-ohh
本次测试环境为w7
1.cve-2019-1388利用工具：https://github.com/jas502n/CVE-2019-1388
cve-2019-1388提权影响范围如下：
SERVER
======
Windows 2008r2 7601 ** link OPENED AS SYSTEM **
Windows 2012r2 9600 ** link OPENED AS SYSTEM **
Windows 2016 14393 ** link OPENED AS SYSTEM **
Windows 2019 17763 link NOT opened
WORKSTATION
===========
Windows 7 SP1 7601 ** link OPENED AS SYSTEM **
Windows 8 9200 ** link OPENED AS SYSTEM **
Windows 8.1 9600 ** link OPENED AS SYSTEM **
Windows 10 1511 10240 ** link OPENED AS SYSTEM **
Windows 10 1607 14393 ** link OPENED AS SYSTEM **
Windows 10 1703 15063 link NOT opened
Windows 10 1709 16299 link NOT opened整一个普通用户，然后查看权限
下载好文件以后
右键以管理员身份运行
点击显示详细信息
然后点击颁发者证书信息
点击颁发者链接,随后会弹出来ie
点击页面->另存为
随后这里直接点确定就好
在文件名处输入
c:\windows\system32\*.*（这里*.*必须要输入，然后回车，不然找不到cmd）
随后在目录中寻找cmd.exe右键打开，打开就是system权限
2.cve-2019-0803利用工具：
https://github.com/k8gege/K8tools/blob/master/CVE-2019-0803.exe
漏洞影响范围：
Microsoft Windows Server 2019 0
Microsoft Windows Server 2016 0
Microsoft Windows Server 2012 R2 0
Microsoft Windows Server 2012 0
Microsoft Windows Server 2008 R2 for x64-based Systems SP1
Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
Microsoft Windows Server 2008 for x64-based Systems SP2
Microsoft Windows Server 2008 for Itanium-based Systems SP2
Microsoft Windows Server 2008 for 32-bit Systems SP2
Microsoft Windows Server 1803 0
Microsoft Windows Server 1709 0
Microsoft Windows RT 8.1
Microsoft Windows 8.1 for x64-based Systems 0
Microsoft Windows 8.1 for 32-bit Systems 0
Microsoft Windows 7 for x64-based Systems SP1
Microsoft Windows 7 for 32-bit Systems SP1
Microsoft Windows 10 Version 1809 for x64-based Systems 0
Microsoft Windows 10 Version 1809 for ARM64-based Systems 0
Microsoft Windows 10 Version 1809 for 32-bit Systems 0
Microsoft Windows 10 Version 1803 for x64-based Systems 0
Microsoft Windows 10 Version 1803 for ARM64-based Systems 0
Microsoft Windows 10 Version 1803 for 32-bit Systems 0
Microsoft Windows 10 version 1709 for x64-based Systems 0
Microsoft Windows 10 Version 1709 for ARM64-based Systems 0
Microsoft Windows 10 version 1709 for 32-bit Systems 0
Microsoft Windows 10 version 1703 for x64-based Systems 0
Microsoft Windows 10 version 1703 for 32-bit Systems 0
Microsoft Windows 10 Version 1607 for x64-based Systems 0
Microsoft Windows 10 Version 1607 for 32-bit Systems 0
Microsoft Windows 10 for x64-based Systems 0
Microsoft Windows 10 for 32-bit Systems 0首先普通用户尝试创建用户，发现失败
使用exp尝试
命令格式：
cve-2019-0803 cmd “net user admin999 admin /add”
显示命令成功完成，但是如果可能在真实环境中，用shell去执行命令时是没有回显的
查看用户，添加成功
本文参与 腾讯云自媒体分享计划，分享自微信公众号。
原始发表：2020-04-15，如有侵权请联系 cloudcommunity@tencent.com 删除
评论
登录后参与评论
推荐阅读