CVE-2018-6606
HIGHMalwareFox AntiMalware 2.74.0.150 - Privilege Escalation via IOCTL 0x80002010 and 0x8000204C
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-6606. PoCs published by Souhail Hammou, bullhead-repo.
AI-analyzed exploit summary This exploit demonstrates a local privilege escalation vulnerability in MalwareFox AntiMalware 2.74.0.150 by abusing an IOCTL (0x80002010) to register a process as trusted by the driver, then using another IOCTL (0x8000204C) to obtain a full-access handle to winlogon.exe, ultimately injecting shellcode to spawn a SYSTEM shell.
Description
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by sending IOCTL 0x80002010 and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.
Exploits (2)
This exploit demonstrates a local privilege escalation vulnerability in MalwareFox AntiMalware 2.74.0.150 by abusing an IOCTL (0x80002010) to register a process as trusted by the driver, then using another IOCTL (0x8000204C) to obtain a full-access handle to winlogon.exe, ultimately injecting shellcode to spawn a SYSTEM shell.
This repository contains a functional exploit for CVE-2018-6606, which leverages a vulnerable driver (ZemanaAntiMalware) to terminate arbitrary processes by PID. The exploit embeds a malicious driver in its resources, loads it as a service, and uses DeviceIoControl to interact with the driver for privilege escalation and process termination.
References (2)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H