CVE-2019-16098
HIGH EXPLOITED IN THE WILD RANSOMWAREMicro-Star MSI Afterburner 4.6.2.15658 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2019-16098 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 6 public exploits from researchers including Barakat, Offensive-Panda, 0xDivyanshu-new.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-16098, which leverages arbitrary memory read/write capabilities in Micro-Star MSI Afterburner's RTCore64.sys driver to escalate privileges to SYSTEM. The exploit demonstrates token stealing by overwriting the current process token with the System process token.
Description
The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Exploits (6)
This repository contains a functional exploit for CVE-2019-16098, which leverages arbitrary memory read/write capabilities in Micro-Star MSI Afterburner's RTCore64.sys driver to escalate privileges to SYSTEM. The exploit demonstrates token stealing by overwriting the current process token with the System process token.
This repository contains a functional exploit for CVE-2019-16098, targeting the Micro-Star MSI Afterburner driver (RTCore64.sys) to achieve local privilege escalation by dynamically calculating Ntoskrnl.exe offsets and stealing the SYSTEM token.
This repository contains a functional exploit for CVE-2019-16098, targeting the RTCore64.sys driver to achieve local privilege escalation (LPE) by manipulating process tokens. The exploit leverages vulnerable IOCTL codes to read/write kernel memory and ultimately spawn a SYSTEM-level cmd.exe process.
This PoC demonstrates CVE-2019-16098 by exploiting the RTCore64.sys driver's arbitrary memory read vulnerability via IOCTL 0x80002048. It continuously monitors a secret value in memory to detect handle closure or tampering.
This repository contains a functional exploit for CVE-2019-16098, which leverages arbitrary memory read/write capabilities in the Micro-Star MSI Afterburner driver (RTCore64.sys) to escalate privileges to SYSTEM. The exploit demonstrates token stealing by overwriting the current process token with the System process token.
The repository claims to exploit CVE-2019-16098 for kernel driver loading but provides no actual exploit code, technical details, or proof-of-concept. It appears to be a lure for malicious ransomware distribution under the guise of academic research.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H