CVE-2015-0002
Microsoft Windows - Privilege Escalation via AhcVerifyAdminContext Impersonation Token Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2015-0002.
PoCs published by Google Security Research, James Forshaw, sinn3r, including Metasploit module exploits/windows/local/ntapphelpcachecontrol.
AI-analyzed exploit summary The writeup details a local privilege escalation vulnerability in Windows 8.1 via NtApphelpCacheControl, where impersonation token checks are bypassed to manipulate the AppCompat cache. The PoC abuses the BITS service to gain an impersonation token and forces a UAC auto-elevate executable to load a malicious DLL.
Description
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
Exploits (2)
The writeup details a local privilege escalation vulnerability in Windows 8.1 via NtApphelpCacheControl, where impersonation token checks are bypassed to manipulate the AppCompat cache. The PoC abuses the BITS service to gain an impersonation token and forces a UAC auto-elevate executable to load a malicious DLL.
This Metasploit module exploits CVE-2015-0002, a local privilege escalation vulnerability in Windows 8/8.1 due to improper authorization checks in NtApphelpCacheControl. It bypasses admin checks by impersonating a system token and injects a payload DLL to achieve elevated privileges.