CVE-2020-10665 PoC — Docker Desktop 后置链接漏洞

Source

https://github.com/spaceraccoon/CVE-2020-10665

Associated Vulnerability

Title:Docker Desktop 后置链接漏洞 (CVE-2020-10665)
Description:Docker是美国Docker公司的一款开源的应用容器引擎。该产品支持在Linux系统上创建一个容器（轻量级虚拟机）并部署和运行应用程序，以及通过配置文件实现应用程序的自动化安装、部署和升级。Docker Desktop是Docker的桌面版。 Docker Desktop中存在安全漏洞。攻击者可利用该漏洞覆盖任意的DACL权限并写入任意文件。以下产品及版本受到影响：Docker Desktop Enterprise 2.1.0.9之前版本，Docker Desktop for Windows Stabl

Description

POC for CVE-2020-10665 Docker Desktop Local Privilege Escalation

Readme

# CVE-2020-10665 Docker Desktop Local Privilege Escalation

POC for Docker Desktop Local Privilege Escalation. Built based on the writeup at https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665.

![POC Video](CVE-2020-10665.gif)

Hardlink creation adapted from https://github.com/googleprojectzero/symboliclink-testing-tools.

This exploit grants full control permissions for the Everyone group to `C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms003.inf_amd64_a337db27fa50b915\\Amd64\\PrintConfig.dll`. To affect other files, simply change the line `LPCWSTR dllPath = L"C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms003.inf_amd64_a337db27fa50b915\\Amd64\\PrintConfig.dll";` in `CVE-2020-10665/CVE-2020-10665.cpp`.

By overwriting `PrintConfig.dll`, attackers can escalate arbitrary file overwrite to SYSTEM access based on the steps at https://decoder.cloud/2019/11/13/from-arbitrary-file-overwrite-to-system/. You will need to modify the `xps.ps1` script in that writeup to point to the matching `PrintConfig.dll` path on the target system as well as generate your own reverse shell payload DLL.

## Affected Products

* Docker Desktop Enterprise before 2.1.0.9
* Docker Desktop for Windows Stable before 2.2.0.4
* Docker Desktop for Windows Edge before 2.2.2.0

Due to the hardlink mitigation introduced in the March 2020 Windows cumulative update, this exploit only works on prior versions of Windows.

File Snapshot


 [4.0K]  /data/pocs/65005964ae1816ed1f7d17cbe63d716ecf046f18
├── [4.0K]  CVE-2020-10665
│   ├── [3.0K]  CommonUtils.cpp
│   ├── [ 579]  CommonUtils.h
│   ├── [1.6K]  CreateNativeHardlink.cpp
│   ├── [3.9K]  CVE-2020-10665.cpp
│   ├── [7.4K]  CVE-2020-10665.vcxproj
│   ├── [1.6K]  CVE-2020-10665.vcxproj.filters
│   ├── [2.2K]  ntimports.h
│   ├── [  19]  stdafx.cpp
│   ├── [ 255]  stdafx.h
│   └── [1.3K]  typed_buffer.h
├── [2.1M]  CVE-2020-10665.gif
├── [1.4K]  CVE-2020-10665.sln
└── [1.4K]  README.md

1 directory, 13 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!