CVE-2020-17103

This repository contains a functional exploit for CVE-2020-17103, leveraging a race condition in Windows Cloud Experience Host to achieve local privilege escalation (LPE) via registry key manipulation and token impersonation.

This repository contains a functional exploit for CVE-2020-17103, leveraging a Windows Error Reporting (WER) task to achieve local privilege escalation (LPE) by manipulating registry keys and executing a payload as SYSTEM. The exploit chain involves registry manipulation, token impersonation, and process creation.

This repository contains a functional exploit for CVE-2020-17103, a local privilege escalation vulnerability in Windows Error Reporting (WER). The exploit leverages a race condition and registry manipulation to execute arbitrary code as SYSTEM by hijacking the WER task.

The repository claims to provide a technical mitigation advisory for CVE-2020-17103 but only contains a README with a link to an external PDF download. No actual exploit code or technical details are provided.

This repository contains a Sigma detection rule for identifying the exploitation of CVE-2020-17103, a Windows local privilege escalation vulnerability involving a race condition in cldflt.sys to hijack the windir environment variable. The rule detects registry writes to USER\.DEFAULT\Volatile Environment\windir, a key exploit primitive.

This repository contains a functional exploit for CVE-2020-17103, leveraging a race condition in Windows Cloud Experience Host to achieve local privilege escalation (LPE) via registry key manipulation and symbolic link abuse.

This repository contains a functional exploit for CVE-2020-17103, leveraging the CfAbortOperation API to manipulate registry keys and achieve privilege escalation. The PoC demonstrates arbitrary registry key manipulation and symbolic link creation to escalate privileges.

This repository contains a functional exploit for CVE-2020-17103, leveraging the CfAbortOperation API to manipulate registry keys and achieve privilege escalation. The PoC demonstrates arbitrary registry key manipulation and token impersonation to escalate privileges.