Privilege escalation in Microsoft Windows and Windows Server - CVE-2018-8440

Vulnerability details

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to ALPC access control flaw. A local attacker can create a hard link from a readable file on the system to a '.job' file in the 'c:\windows\tasks' directory, invoke the _SchRpcSetSecurity() method of the task scheduler service ALPC endpoint to overwrite the linked file and gain system level privileges on the target system. The vulnerability was dubbed "SendboxEscaper".

Note: the vulnerability is being exploited in the wild by the PowerPool group.

Affected software

How to mitigate CVE-2018-8440

Links to Public Exploits and PoC-codes

• Exploit #209 - CVE-2018-8440 (CVE-2018-8440 standalone exploit) (March 18, 2020)
• Exploit #1524 - Microsoft Windows ALPC Task Scheduler Local Privilege Elevation (March 18, 2020)

External References

• https://twitter.com/SandboxEscaper/status/1034125195148255235
• https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar
• https://www.kb.cert.org/vuls/id/906424
• https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440

Related Security Bulletins

• Privilege escalation in Microsoft Windows