83d2726c75
14 changes to exploits/shellcodes SpotDialup 1.6.7 - 'Name' Denial of Service (PoC) SpotOutlook 1.2.6 - 'Name' Denial of Service (PoC) Top Password Software Dialup Password Recovery 1.30 - Denial of Service (PoC) Backup Key Recovery 2.2.5 - 'Name' Denial of Service (PoC) TaskCanvas 1.4.0 - 'Registration' Denial Of Service Top Password Firefox Password Recovery 2.8 - Denial of Service (PoC) Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions Allok Video Converter 4.6.1217 - Stack Overflow (SEH) Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH) Microsoft Windows 10 build 1809 - Local Privilege Escalation (UAC Bypass) Chevereto 3.13.4 Core - Remote Code Execution Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit) Digi AnywhereUSB 14 - Reflective Cross-Site Scripting
35 lines
No EOL
1.2 KiB
Text
35 lines
No EOL
1.2 KiB
Text
# Exploit Title: TotalAV 2020 4.14.31 - Privilege Escalation
|
|
# Date: 2020-01-09
|
|
# Exploit Author: Kusol Watchara-Apanukorn
|
|
# Vendor Homepage: https://www.totalav.com/
|
|
# Version: 4.14.31
|
|
# Fixed on: 5.3.35
|
|
# Tested on: Windows 10 x64
|
|
# CVE : CVE-2019-18194
|
|
|
|
# Vulnerability Description:
|
|
# TotalAV 2020 4.14.31 has quarantine flaw that allows attacker escape of
|
|
# privilege by using NTFS directory junction.
|
|
|
|
**You can download vulnerability version with this link:
|
|
https://install.protected.net/windows/cdn3/4.14.31/TotalAV_Setup.exe
|
|
|
|
///////////////////////////////////
|
|
Proof of Concept
|
|
//////////////////////////////////
|
|
1. Plant the malicious file in this case we use DLL file
|
|
2. To exploit the vulnerability antivirus must detect the malicious dll
|
|
3. Move it to quarantine.
|
|
4. Attacker must create NTFS directory junction to restore
|
|
|
|
Full step: https://www.youtube.com/watch?v=88qeaLq98Gc
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
17 Oct, 19 : Found Vulnerability
|
|
18 Oct, 19 : Vendor Notification
|
|
18 Oct, 19 : Request CVE
|
|
21 Oct, 19 : Vendor Response
|
|
mid Dec, 19 : Vendor released new patched (v5.3.35)
|
|
09 Jan, 20: Vulnerability Disclosure |