# CVE-2019-1388 Privilege Escalation
CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7.
# CVE-2019-1388: Windows UAC Privilege Escalation Lab

An educational cybersecurity lab and technical analysis documenting **CVE-2019-1388**—a local privilege escalation vulnerability in the Windows Certificate Dialog allowing a low-privileged user to gain `NT AUTHORITY\SYSTEM` access.

---

## Technical Overview

* **CVE ID:** CVE-2019-1388
* **Vulnerability Type:** Local Privilege Escalation / UAC Bypass
* **Target Environment:** Windows 7 Ultimate (VirtualBox)
* **Impact:** Complete system compromise (Confidentiality, Integrity, Availability)
* **Root Cause:** Improper privilege enforcement in the Windows Certificate Dialog when spawning web browser processes during publisher verification.

---

## Lab Environment & Prerequisites

* **Hypervisor:** VirtualBox
* **Guest OS:** Windows 7 Ultimate (Configured with standard `Guest` and `Admin` accounts)
* **Tools:** Target binary (`hhupd.exe`), Internet Explorer, Windows Explorer, `cmd.exe`

---

## Step-by-Step Exploitation Walkthrough

<Sequence>
{/* Reason: Demonstrates the sequential steps required to trigger and exploit the UAC privilege escalation vulnerability safely. */}
  <Step title="1. Verify Initial Privileges" subtitle="Guest Account">
    Log into the Windows 7 Virtual Machine as the **Guest** user. Open the Command Prompt and verify low privilege status:
    ```cmd
    whoami
    ```
  </Step>
  <Step title="2. Trigger User Account Control (UAC)" subtitle="Run as Administrator">
    Download the targeted executable (`hhupd.exe`). Right-click the binary, select **Properties**, and uncheck the web marker (Unblock). Right-click again and select **Run as Administrator** to trigger the UAC prompt.
  </Step>
  <Step title="3. Access Elevated Certificate Dialog" subtitle="Browser Hijack">
    On the UAC prompt, click **Show details** $\rightarrow$ **Show information about this publisher's certificate**. In the certificate viewer, click the **VeriSign** hyperlink to launch Internet Explorer running under `NT AUTHORITY\SYSTEM` privileges.
  </Step>
  <Step title="4. Elevate Command Prompt" subtitle="SYSTEM Shell">
    Dismiss the UAC prompt. In the high-privilege browser window, select **File** $\rightarrow$ **Save As...**. Navigate to `C:\Windows\System32`, change the file type filter to *All Files*, locate `cmd.exe`, right-click it, and select **Open**.
  </Step>
  <Step title="5. Confirm Escalation & Post-Exploitation" subtitle="NT AUTHORITY\SYSTEM">
    In the newly spawned terminal, verify elevated SYSTEM rights and access restricted administrator directories:
    ```cmd
    whoami
    cd C:\Users\Admin\Desktop
    dir
    copy image.jpg C:\Users\Guest\Desktop
    ```
  </Step>
</Sequence>

---

## Mitigation & Remediation

* **Patching:** Apply Microsoft's November 2019 Security Update (KB4524445 or relevant OS cumulative update).
* **Least Privilege:** Ensure User Account Control (UAC) enforcement policies strictly validate certificate link handling routines.