Privilege Escalation via Junction Handling in Windows AppX Deployment Server

This repository contains multiple proof-of-concept (PoC) exploits for CVE-2019-1253, a local privilege escalation vulnerability in the Windows AppX Deployment Service (AppXSVC). The exploit targets Windows 10 and Windows Server 2019 systems prior to the September 2019 patch. The repository is organized into two main PoCs: one leveraging Microsoft Edge (AppxExploit_Edge) and another leveraging Cortana (AppxExploit_Cortana). Both PoCs use NTFS junctions and hardlinks to manipulate file permissions, ultimately granting the 'Authenticated Users' group MODIFY or FULL CONTROL rights on arbitrary files owned by SYSTEM. The exploit requires local access and is not remote. The batch script (appexploit.bat) provides a simplified version of the exploit using command-line utilities. The code is written in C# and demonstrates advanced manipulation of Windows file system features to achieve privilege escalation. The repository also includes detailed documentation and usage instructions in the README files.

This repository contains an exploit for CVE-2019-1253, a local privilege escalation vulnerability affecting Microsoft Windows 10 (x32 and x64) via Microsoft Edge. The main exploit logic is implemented in C# (PrivilegedFileDelete/Program.cs) and a PowerShell script (exploit.ps1). The exploit works by deleting the Edge Settings folder, creating a directory junction (symlink) from that location to an attacker-specified target, and then launching Edge to trigger privileged deletion of the target folder. This can be used to delete arbitrary files or folders with elevated privileges, potentially leading to privilege escalation or a permanent denial of service. The exploit is operational and requires local access to the target system. The repository structure includes Visual Studio project files, build artifacts, the main C# source code, and a standalone PowerShell script that performs the same attack steps. The exploit is destructive and should be used with caution.

This repository contains a C++ proof-of-concept exploit for CVE-2019-1253, a local privilege escalation vulnerability in Microsoft Windows AppXSvc. The exploit abuses the AppXSvc service's handling of hard links to overwrite the security descriptor of an arbitrary file, granting the attacker full control permissions. The main entry point is 'AppXSvcEoP.cpp', which orchestrates the attack by creating a hard link from a file in the Microsoft Edge settings directory to a target file (e.g., C:\Windows\win.ini), then triggers the AppXSvc service to process the file, resulting in the security descriptor overwrite. The exploit is local-only and requires the attacker to have code execution on the target system. The repository is structured as a Visual Studio C++ project, with supporting utility and header files for Windows API interaction, privilege manipulation, and hard link creation. No network endpoints are present; all actions are performed on the local file system.