CVE-2018-6606

HIGH

MalwareFox AntiMalware 2.74.0.150 - Privilege Escalation

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-6606 has a selected CVSS score of 7.8 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by sending IOCTL 0x80002010 and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Proofs of concept

2

Catalogued exploits

ExploitDBMalwareFox AntiMalware 2.74.0.150 - Privilege EscalationExploitDB exploitby Souhail HammouNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubbullhead-repo/CVE-2018-6606Repository PoCby bullhead-repo0Exploit5 files

7.0 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C program that extracts an embedded kernel driver, installs it as a service, and uses IOCTL codes to terminate an arbitrary process by PID, requiring administrator privileges.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2018-6606 is a local privilege escalation exploit that extracts an embedded kernel driver, installs it as a service, and uses IOCTL calls to terminate a target process. The code is straightforward and matches the disclosed vulnerability description. No concealed network activity, data exfiltration, or unrelated payload execution was found. The binary driver is uninspected, but its use is the core of the disclosed exploit.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareMalwareFox AntiMalwarezam32.syszam64.sys
Attack typesprivilege escalationdenial of service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2018-6606 by loading a vulnerable driver and sending IOCTL codes to terminate an arbitrary process, which constitutes privilege escalation/denial of service exploitation, not mere detection or scanning.

main.c:130-155README.md:3

Requirements

  • Administrator privileges are required to write the driver to System32 and create/start the kernel service.README.md:6
  • The target process ID (PID) must be provided as a command-line argument.main.c:22-25

Observed behavior

  • Extracts an embedded .sys driver from the executable's resource section and writes it to payload withheld.main.c:42-86
  • Creates and starts a kernel driver service named 'dot_sys'.main.c:88-114
  • Opens a handle to \\.\ZemanaAntiMalware and sends IOCTL 0x80002010 to register the current process with the driver.main.c:116-142
  • Sends IOCTL 0x80002048 with the target PID to terminate the specified process.main.c:144-155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
Payload withheldThe PoC writes an embedded driver to the system drivers directory, which is required for the privilege escalation exploit.main.c:62-70
Service Creation
Payload withheldThe PoC creates and starts a kernel driver service to interact with the vulnerable driver.main.c:88-108
Ioctl Call
Payload withheldThe PoC uses IOCTL codes to register with the vulnerable driver and terminate a target process, matching the CVE description.main.c:130-154
Review boundaries

What the analysis did not establish

  • The embedded .sys driver (dot_sys.sys) is a binary file that was not inspected; its exact behavior is inferred from the C code and CVE description.
  • The resource.rc file and Makefile are not included in the text evidence, so the exact resource embedding and compilation steps are not fully visible.
  • The code was not executed; classification is based solely on static analysis of the provided source.
  • The embedded binary driver (dot_sys.sys) was not inspected and could contain additional behavior beyond the disclosed exploit, but no evidence suggests it does.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3