CVE-2019-16098 PoC — Micro Star MSI Afterburner 安全漏洞

Source

https://github.com/0xDivyanshu-new/CVE-2019-16098

Associated Vulnerability

Title:Micro Star MSI Afterburner 安全漏洞 (CVE-2019-16098)
Description:The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

Readme

# CVE-2019-16098

This CVE exploits the RTCore64.sys driver and creates a cmd.exe process with system privileges by copying the token of the System process with one of the low-privilege cmd.exe process.

Blog about the approach and the methodology can be found [here](https://divyanshu-mehta.gitbook.io/researchs/windows-security-research/exploit-development/rtcore64.sys-cve-2019-16098).

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →