Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.8
CVSSv3

CVE-2019-1405

Published: 12/11/2019 Updated: 01/03/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Windows Server 2008

Vulnerability Summary

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2008 r2

microsoft windows server 2012 r2

microsoft windows 10 1607

microsoft windows 8.1 -

microsoft windows server 2016 -

microsoft windows server 2008 -

microsoft windows 7 -

microsoft windows rt 8.1 -

microsoft windows server 2012 -

microsoft windows 10 -

microsoft windows 10 1709

microsoft windows 10 1803

microsoft windows server 2016 1803

microsoft windows server 2019 -

microsoft windows 10 1809

microsoft windows server 2016 1903

microsoft windows 10 1903

Exploits

Exploit DB: Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation
## EDB Note Download: - githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47684-1exe - githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47684-2zip # COMahawk **Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322** ## Video Demo vimeocom/373051209 ## Usa ...

Mailing Lists

Packetstorm: Microsoft UPnP Local Privilege Elevation
This Metasploit module exploits two vulnerabilities to execute a command as an elevated user The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM ...

Metasploit Modules

Microsoft UPnP Local Privilege Elevation Vulnerability

This exploit uses two vulnerabilities to execute a command as an elevated user. The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM.

msf > use exploit/windows/local/comahawk
msf exploit(comahawk) > show targets
    ...targets...
msf exploit(comahawk) > set TARGET < target-id >
msf exploit(comahawk) > show options
    ...show and set options...
msf exploit(comahawk) > exploit

Github Repositories

Erebus

CobaltStrike后渗透测试插件

Erebus CobaltStrike后渗透测试插件 部分功能只适用于cobalt strike 4x 由于异步处理问题，某些功能可能会存在BUG 暂时未找到解决方法，如果大佬们有解决方案，欢迎联系我~ 更新日志 2020-07-31(V134) 添加fakelogonscreen命令 添加SpaceRunner 此工具用于将任意PowerShell代码编译为C#程序，而无需通过使

COMahawk

Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322

COMahawk Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322 Video Demo vimeocom/373051209 Usage Compile or Download from Release (githubcom/apt69/COMahawk/releases) Run COMahawkexe ??? Hopefully profit or COMahawkexe "custom command to run" (ie COMahawkexe "net user /add test123 lol123 &amp;") ??? Hopefully profit

Windows提权工具 CVE-2019-1405 &amp; CVE-2019-1322 k8gegeorg/p/19321html 漏洞介绍 由NCC Group研究人员所发现的两个通过COM本地服务进行非法提权的漏洞。第一个漏洞CVE-2019-1405是COM服务中的一个逻辑错误，可让本地普通用户以LOCAL SERVICE身份执行任意命令。第二个漏洞CVE-2019-1322是一个简单的服

Erebus CobaltStrike后渗透测试插件 部分功能只适用于cobalt strike 4x 由于异步处理问题，某些功能可能会存在BUG 暂时未找到解决方法，如果大佬们有解决方案，欢迎联系我~ 更新日志 2021-10-28(V137) 添加collector defender信息 post模块添加BypasUAC功能 更新日志 2021-06-07(V136) 移除post模块migrate功能

Relevant - Penetration Testing Challenge Bradley Lubow | rnbochsr, September 2022 My notes and solutions for the TryHackMecom's Relevant room Task 1 - Pre-Engagement Briefing You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in seven days Scope of Work The client requests that an engineer cond

patch-checker

Web-based check for Windows privesc vulnerabilities

PatchChecker This is the code base for the service running on: patchcheckercom In short, PatchChecker is a web application (running on flask) that provides output similar to that of Watson However by using PatchChecker, one is not required to execute a binary on the target machine Included in this project is also a web scraper that will automatically update the data

K8tools

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

K8tools 2020628 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 下载: githubcom/k8gege/K8tools 文档: k8gegeorg PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意

ContiLeaks

Unclaimed victims: 1-gridcom Andersonautomotivecom Xerox Ticket Master Group Angelino Rockford School District HUDSON PROPERTIES GRANT &amp; WEBER Koons Automotive SDIGC HOULE ELEC GROUPDOMAIN Perennials Fabrics Skecoplantcom Guardiaciviles Birkenstockcom BTC/BECH32 addresses: 1HtyXyCrshiJmLYNru7atpDMJrzG9mzwzf 1FWWRT88WjYbZp4NoRNEBgTGjRxhi2J9YM 15gjb8F5Zd8XR

dazzleUP

A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems.

dazzleUP A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems dazzleUP detects the following vulnerabilities Exploit Checks The first feature of dazzleUP is that it uses Windows Update Agent API instead of WMI (like others) when finding missing patches dazzleUP checks the following vuln

dazzleUP

dazzleUP A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems dazzleUP detects the following vulnerabilities Exploit Checks The first feature of dazzleUP is that it uses Windows Update Agent API instead of WMI (like others) when finding missing patches dazzleUP checks the following vuln

0xsp-Mongoose

a unique framework for cybersecurity simulation and red teaming operations, windows auditing for newer vulnerabilities, misconfigurations and privilege escalations attacks, replicate the tactics and techniques of an advanced adversary in a network.

0xsp Mongoose Red for Winodws 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted windows operation system for system vulnerabilities, misconfigurations and privilege escalation attacks and replicate the tactics and techniques of an advanced adversary in a network with node js s

Conti-Clear

Conti-Clear Extracted data &amp; informations from the Conti &amp; TrickBot leaks The beginning Well, Since Tob Trick started leaking Conti chats and conversations, most of people started translating them using translators like Deepl or Google Translate You can find the original + transalted chats of the Conti TrickBot Leaks here : conti-leaks-englished After tha

SymBlock

A windows kernel driver to Block symbolic link exploit used for privilege escalation.

Symblock A unique windows kernel driver to protect your system from privilege escalation due to symbolic link exploits Usage Tested on Windows 10 and Windows 7 Compile the driver Update inf file according to your usage Install inf file by right click-&gt; install Load the driver using net start drivername You can use debugview tool to get the debug message generated T

RedTeamer

红方人员作战执行手册

红方人员实战手册 声明 Author : By klion Date : 2020215 寄语 : 愿 2020 后面的每一天都能一切安好 分享初衷 一来, 旨在为 "攻击" / "防御"方 提供更加全面实用的参考 还是那句老闲话 "未知攻焉知防", 所有单纯去说 "攻" 或者 "防" 的都是耍流氓, 攻守兼备

RedTeamer

红方人员实战手册 声明 Author : By klion Date : 2020215 寄语 : 愿 2020 后面的每一天都能一切安好 分享初衷 一来, 旨在为 "攻击" / "防御"方 提供更加全面实用的参考 还是那句老闲话 "未知攻焉知防", 所有单纯去说 "攻" 或者 "防" 的都是耍流氓, 攻守兼备

WindowsElevation

What's this This project is mainly used to collect the commonly used exp of Windows platform and give the relevant repair scheme On the one hand, it is helpful for security researchers to quickly complete the right raising in the process of penetration testing, on the other hand, it is also helpful for the project party to find the unmatched vulnerability patches accordin

RedTeamer

红方人员作战执行手册

红方人员实战手册 声明 Author : By klion Date : 2020215 寄语 : 愿 2020 后面的每一天都能一切安好 分享初衷 一来, 旨在为 "攻击" / "防御"方 提供更加全面实用的参考 还是那句老闲话 "未知攻焉知防", 所有单纯去说 "攻" 或者 "防" 的都是耍流氓, 攻守兼备

WindowsElevation

What's this This project is mainly used to collect the commonly used exp of Windows platform and give the relevant repair scheme On the one hand, it is helpful for security researchers to quickly complete the right raising in the process of penetration testing, on the other hand, it is also helpful for the project party to find the unmatched vulnerability patches accordin

poc

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

Penetration_Testing_POC

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

Penetration_PoC

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

gongkaishouji

公开收集所用

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

-

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

Penetration_Testing_POC

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

penetration_poc

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

sec-daily-2019

2019年天融信阿尔法实验室在微信公众号发布的所有安全资讯汇总

欢迎关注天融信阿尔法实验室微信公众号 20191231 [技术] 使用IDA从零开始学逆向, Part27 mediumcom/p/5fa5c173547c 36C3 CTF Writeups bananamafiadev/post/36c3ctf/ 再探同形文字攻击 alephsecuritycom/2019/12/29/revised-homograph-attacks/ 对1个Dell SonicWALL虚拟办公室的登录界面进行Password Spraying攻击

Penetration_Testing_POC

渗透测试有关的POC、EXP、脚本、提权、小工具等，欢迎补充、完善---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss penetration-testing-poc csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile

TOP all Top Top Top_Codeql TOP All bugbounty pentesting CVE-2022- POC Exp Things Table of Contents 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2013 year top total 30 2022 star name url des 961 CVE-2022-0847-

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。 请注意所有工具是否有后门或者其他异常行为，建议均在虚拟环境操作。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&amp;Mobile Phone Web APP 提权辅助相关 PC tools-小工具集

TOP all Top Top Top_Codeql TOP All bugbounty pentesting CVE-2022- POC Exp Things Table of Contents 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2013 year top total 30 2022 star name url des 975 CVE-2022-0847-

TOP all Top Top Top_Codeql TOP All bugbounty pentesting CVE-2022- POC Exp Things Table of Contents 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2013 year top total 30 2022 star name url des 988 CVE-2022-0847-

Table of Contents 2023 year top total 30 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2023 star updated_at name url des 304 2023-03-18T21:10:14Z Windows_LPE_AFD_CVE-2023-21768 githubcom/chompie1337/Wi

Table of Contents 2023 year top total 30 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2023 star updated_at name url des 323 2023-03-23T01:27:35Z Windows_LPE_AFD_CVE-2023-21768 githubcom/chompie1337/Wi

Table of Contents 2023 year top total 30 2022 year top total 30 2021 year top total 30 2020 year top total 30 2019 year top total 30 2018 year top total 30 2017 year top total 30 2016 year top total 30 2015 year top total 30 2014 year top total 30 2013 year top total 30 2012 year top total 30 2011 year top total 30 2010 year top total 30 2009 year top total 30 2008 year top to

PoC

PoC in GitHub 2021 CVE-2021-1056 (2021-01-07) NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidiako) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure pokerfaceSad/CVE-2021-1056 CVE-2021-

PoC-in-GitHub

PoC in GitHub 2021 CVE-2021-1056 (2021-01-07) NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidiako) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure pokerfaceSad/CVE-2021-1056 CVE-2021-

CVE-POC

PoC in GitHub 2020 CVE-2020-0014 It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android ID: A-1286745

PoC-in-GitHub

PoC in GitHub 2020 CVE-2020-0014 (2020-02-13) It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android

PoC-in-GitHub

PoC auto collect from GitHub.

PoC in GitHub 2020 CVE-2020-0022 In reassemble_and_dispatch of packet_fragmentercc, there is possible out of bounds write due to an incorrect bounds calculation This could lead to remote code execution over Bluetooth with no additional execution privileges needed User interaction is not needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Andr

Recent Articles

Microsoft Patch Tuesday – November 2019
Symantec Threat Intelligence Blog • Ratheesh PM • 15 Nov 2023

This month the vendor has patched 75 vulnerabilities, 14 of which are rated Critical.

Posted: 15 Nov, 201922 Min ReadThreat Intelligence SubscribeMicrosoft Patch Tuesday – November 2019This month the vendor has patched 75 vulnerabilities, 14 of which are rated Critical.As always, customers are advised to follow these security best practices:


Install vendor patches as soon as they are available.
Run all software with the least privileges required while still maintaining functionality.
Avoid handl...

Read more...

References

NVD-CWE-noinfohttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.htmlhttps://nvd.nist.govhttps://github.com/DeEpinGh0st/Erebushttps://www.exploit-db.com/exploits/47684https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/110765
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-25675CVE-2023-21072physicalCVE-2023-28446encryptionCVE-2023-21076server-side request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook