CVE-2020-0787
HIGH KEV RANSOMWAREWindows BITS - Elevation of Privilege via Symbolic Link Mishandling
Title source: llmExploitation Summary
CVE-2020-0787 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 28, 2022, with confirmed use in ransomware campaigns.
EIP tracks 10 public exploits from researchers including cbwang505, yanghaoi, itm4n, gwillcox-r7, including a Metasploit module exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.
AI-analyzed exploit summary This is a working proof-of-concept exploit for CVE-2020-0787, a vulnerability in Windows BITS (Background Intelligent Transfer Service) that allows arbitrary file moves via symbolic link manipulation and mountpoint redirection. The exploit leverages BITS job manipulation and oplock techniques to achieve local privilege escalation.
Description
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
Exploits (10)
This is a working proof-of-concept exploit for CVE-2020-0787, a vulnerability in Windows BITS (Background Intelligent Transfer Service) that allows arbitrary file moves via symbolic link manipulation and mountpoint redirection. The exploit leverages BITS job manipulation and oplock techniques to achieve local privilege escalation.
This repository contains a proof-of-concept exploit for CVE-2020-0787, a vulnerability in Windows BITS (Background Intelligent Transfer Service) that allows arbitrary file moves via symbolic link manipulation and mountpoint switching. The exploit leverages BITS job manipulation and oplock techniques to achieve local privilege escalation.
This Metasploit module exploits CVE-2020-0787, an arbitrary file move vulnerability in the Background Intelligent Transfer Service (BITS) to overwrite a system DLL and achieve privilege escalation via DLL hijacking in the Update Session Orchestrator service.
This repository contains a functional exploit for CVE-2020-0787, a vulnerability in the Windows Background Intelligent Transfer Service (BITS) that allows arbitrary file moves. The exploit leverages COM object manipulation and file operations to achieve privilege escalation.
This repository contains a functional exploit for CVE-2020-0787, a vulnerability in the Windows Background Intelligent Transfer Service (BITS) that allows arbitrary file moves. The exploit leverages COM object manipulation and file operations to achieve privilege escalation.
This repository contains a functional exploit for CVE-2020-0787, a vulnerability in the Windows Background Intelligent Transfer Service (BITS) that allows arbitrary file moves. The exploit leverages COM object manipulation and file operations to achieve privilege escalation.
This repository contains a functional exploit for CVE-2020-0787, a vulnerability in the Windows Background Intelligent Transfer Service (BITS) that allows arbitrary file moves. The exploit leverages COM object manipulation and file operations to achieve privilege escalation.
This repository contains documentation and configuration scripts for a collection of Windows kernel exploits, including CVE-2003-0352, CVE-2006-3439, and others. It includes README files in both Chinese and English, as well as a Python script for generating documentation and navigation configurations.
This repository contains a functional exploit for CVE-2020-0787, a vulnerability in the Windows Background Intelligent Transfer Service (BITS) that allows arbitrary file moves. The exploit leverages COM object manipulation and file operations to achieve privilege escalation.
This repository contains a functional exploit for CVE-2020-0787, leveraging the BITS (Background Intelligent Transfer Service) arbitrary file move vulnerability. The exploit uses mount points, symbolic links, and oplocks to manipulate file operations and achieve privilege escalation.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H