{"uuid": "b7ced5f7-70dc-45ff-b15a-51b8de381cb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15732", "type": "seen", "source": "https://t.me/hacking_Attack/7524", "content": "Alternatively, the privilege may be used to unload security-related drivers with ftlMC builtin command. i.e.: fltMC sysmondrv  1. The szkg64 vulnerability (https://www.kitploit.com/search/label/Vulnerability) is listed as CVE-2018-15732 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15732)\n2. The szkg64 exploit code (https://www.greyhathacker.net/?p=1025) was created by Parvez Anwar (https://twitter.com/parvezghh)      SeLockMemory  Availability  3rd party tool  Starve System memory partition by moving pages.  PoC published by Walied Assar (@waleedassar) (https://twitter.com/waleedassar/status/1296689615139676160)      SeMachineAccount  None  -  -  The privilege is not used in the Windows OS.      SeManageVolume  Admin  3rd party tool  1. Enable the privilege in the token\n2. Create handle to \\.\\C: with SYNCHRONIZE | FILE_TRAVERSE\n3. Send the FSCTL_SD_GLOBAL_CHANGE to replace S-1-5-32-544 with S-1-5-32-545\n4. Overwrite utilman.exe etc.  FSCTL_SD_GLOBAL_CHANGE can be made with this piece of code (https://github.com/gtworek/PSBits/blob/master/Misc/FSCTL_SD_GLOBAL_CHANGE.c).      SeProfileSingleProcess  None  -  -  The privilege is checked before changing (and in very limited set of commands, before querying) parameters of Prefetch, SuperFetch, and ReadyBoost. The impact may be adjusted, as the real effect is not known.      SeRelabel  Threat  3rd party tool  Modification of system files by a legitimate administrator?  See: MIC documentation (https://docs.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control)\n \n Integrity labels are infrequently used and work only on top of standard ACLs. Two main scenarios include:\n- protection against attacks using exploitable applications such as browsers, PDF readers etc.\n- protection of OS files.\n \nAttacks with SeRelabel must obey access rules defined by ACLs, which makes them significantly less useful in practice.      SeRemoteShutdown  Availability  Built-in commands  shutdown /s /f /m \\\\server1 /d P:5:19  The privilege is verified when shutdown/restart request comes from the network. 127.0.0.1 scenario to be investigated.      SeReserveProcessor  None  -  -  It looks like the privilege is no longer used and it appeared only in a couple of versions of winnt.h. You can see it listed i.e. in the source code published by Microsoft here (https://code.msdn.microsoft.com/Effective-access-rights-dd5b13a8/sourcecode?fileId=58676&pathId=767997020).      SeRestore  Admin  PowerShell  1. Launch PowerShell/ISE with the SeRestore privilege present.\n2. Enable the privilege with Enable-SeRestorePrivilege (https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1)).\n3. Rename utilman.exe to utilman.old\n4. Rename cmd.exe to utilman.exe\n5. Lock the console and press Win+U  Attack may be detected by some AV software.\n \nAlternative method relies on replacing service binaries stored in \"Program Files\" using the same privilege.      SeSecurity  Threat  Built-in commands  - Clear Security event log: wevtutil cl Security\n \n- Shrink the Security log to 20MB to make events flushed soon: wevtutil sl Security /ms:0\n \n- Read Security event log to have knowledge about processes, access and actions of other users within the system.\n \n- Knowing what is logged to act under the radar.\n \n- Knowing what is logged to generate large number of events effectively purging old ones without leaving obvious evidence of cleaning.        SeShutdown  Availability  Built-in commands  shutdown.exe /s /f /t 1  Allows to call most of NtPowerInformation() levels. To be investigated.      SeSyncAgent  None  -  -  The privilege is not used in the Windows OS.      SeSystemEnvironment  Unknown  3rd party tool  The privilege permits to use NtSetSystemEnvironmentValue, NtModifyDriverEntry and some other syscalls to manipulate UEFI variables.  - Firmware environment variables were commonly used on non-Intel platforms in the past, and now slowly return to UEFI world.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:44.438086Z"}