CVE-2020-16938 PoC — Windows Kernel Information Disclosure Vulnerability

Source

https://github.com/ioncodes/CVE-2020-16938

Associated Vulnerability

Title:Windows Kernel Information Disclosure Vulnerability (CVE-2020-16938)
Description:An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system. The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.

Description

Bypassing NTFS permissions to read any files as unprivileged user.

Readme

# CVE-2020-16938

`CVE-2020-16938` is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend [Jonas](https://twitter.com/jonasLyk/status/1316104870987010048). His PoC can be found [here](https://twitter.com/jonasLyk/status/1316104870987010048).

My version of the exploit consists of a bunch of Windows API calls to get the handle directly without using 7zip, the PoC can be found in the `poc` folder which mirrors the [tweet](https://twitter.com/layle_ctf/status/1316108167609188354) I created a while ago.

In short, this exploit allows you to dump the entire disk. The dump in itself can be opened using 7zip or any other parser that supports NTFS.

![](/image/poc.png)

File Snapshot


 [4.0K]  /data/pocs/2fc1cdc9e70d1b47cf759c9000d27ae06cfacb64
├── [4.0K]  image
│   └── [126K]  poc.png
├── [4.0K]  ntfs_bypass
│   ├── [4.0K]  ntfs_bypass
│   │   ├── [1.7K]  ntfs_bypass.cpp
│   │   ├── [7.3K]  ntfs_bypass.vcxproj
│   │   ├── [1.0K]  ntfs_bypass.vcxproj.filters
│   │   ├── [ 165]  ntfs_bypass.vcxproj.user
│   │   └── [ 26K]  wrapper.hpp
│   └── [1.4K]  ntfs_bypass.sln
├── [4.0K]  poc
│   ├── [ 33K]  exploit.exe
│   ├── [ 33K]  exploit_fixed.exe
│   └── [ 337]  poc.txt
└── [ 790]  README.md

4 directories, 11 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!