{"uuid": "739d6d93-89ad-402c-9790-421806a15d5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-1388", "type": "seen", "source": "https://t.me/hacking_Attack/15427", "content": "pot.com/-1imPBLY4a3c/YOKtIJTunbI/AAAAAAAAxTE/eh-ESDbNIf0jhyLeoCt-8sxfjMxEHpYGACLcBGAsYHQ/s16000/5.png ExploitationBrowsing the Ready Player One blog post we saw that Wade has commented a word to remember parzival. This seems an interesting word, there may exist a user by the name of Wade and password parzival.http://10.10.167.18/retro/index.php/2019/12/09/ready-player-one/#comment-2https://1.bp.blogspot.com/-DuW4ROUKuyI/YOKtLpgowgI/AAAAAAAAxTI/zpUw9R9SJFIJO0Xce3J9elodPzjinw7MACLcBGAsYHQ/s16000/6.png We were not able to enumerate the RDP service due to the lack of credentials before. Now that we suspect that we have a set of credentials, let\u2019s try to connect to the service. We will be using xfreerdp for accessing the RDP service. There exist many other tools that you can use for the same. We provided the username wade and password parzival. xfreerdp /u:wade /p:parzival /v:10.10.167.18https://1.bp.blogspot.com/-cy3zsqqk4hc/YOKtPpHXF9I/AAAAAAAAxTQ/0wL9bvrVjTEV6VDVnJnbJyRM5MYJKoSwwCLcBGAsYHQ/s16000/7.png We were able to connect to the RDP service with the credentials we suspected. As soon as we connect, we see that we have the user.txt file on the Desktop. We open the file to find the user flag as demonstrated below.Privilege Escalation Now that we have the user flag and the access of the Wade user, we need to figure out the method for elevating access to the Administrator. Other than the text file we had two other icons on the Desktop. We opened Google Chrome and found a link bookmarked. It was for the Vulnerability CVE-2019-1388. Since we don\u2019t have Internet Access on the target machine, we copied the link and opened it on our local machine. We found that it is a privilege escalation vulnerability inside the Windows Certificate Dialog. We read a couple of articles about it online to understand the vulnerability.Note: During our assessment, there were times where we were not able to open Internet Explorer. We contacted the author of the machine and we were told that this occurs because of creating the vulnerability. He suggested that we restart the machine and open an instance of Internet Explorer before running the hhupd file.After getting the hhupd file to the Desktop, we right-click on the file and choose the Run As Administrator option. We are presented with a dialogue box asking for the password Administrator. Since we don\u2019t have the password, we click on the Show more details option as demonstrated below. ___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:34.174219Z"}