lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 26 Aug 2020 17:01:30 +0630
From: b1nary <>
Subject: [FD] SUPERAntiSpyware Professional X Trial < 10.0.1206 Local
	Privilege Escalation

# Vulnerability Description
SUPERAntiSpyware Professional X Trial versions prior to 10.0.1206 are
vulnerable to local privilege escalation because it allows unprivileged
users to restore quarantined files to a privileged location through a NTFS
directory junction.

# Home Page

# Author: b1nary

# Proof of Concept

   1. Place a dll payload in an empty folder
   2. Scan the payload with the SUPERAntiSpyware Professional X Trial in
   order to get it detected.
   3. Once it is detected and moved to quarantine, create a NTFS directory
   4. Restore the payload and reboot the system.

Full PoC video:

# Timeline

   - 16-07-2020 - Vulnerability discovered
   - 16-07-2020 - Notified the vendor via support form (vendor did not
   - 19-07-2020 - Notified the vendor via email (vendor did not response)
   - 25-07-2020 - Vulnerability report to CERT/CC (VRF#20-07-GBPVY)
   - 25-08-2020 - Vulnerability Disclosed

# References

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists