CVE-2019-1019
HIGHWindows - Security Feature Bypass via NETLOGON Message Session Key Exposure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-1019. PoCs published by Google Security Research.
AI-analyzed exploit summary The writeup details a sandbox escape exploit combining NTLM reflection and an EFSRPC path check bypass to achieve local privilege escalation. It leverages Chromium's sandboxed process to relay NTLM authentication and exploit insufficient path validation in EFSRPC to copy a payload to the Startup folder.
Description
A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an attacker could send a specially crafted authentication request. An attacker who successfully exploited this vulnerability could access another machine using the original user privileges. The issue has been addressed by changing how NTLM validates network authentication messages.
Exploits (1)
The writeup details a sandbox escape exploit combining NTLM reflection and an EFSRPC path check bypass to achieve local privilege escalation. It leverages Chromium's sandboxed process to relay NTLM authentication and exploit insufficient path validation in EFSRPC to copy a payload to the Startup folder.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H