PT-2019-4538 · Microsoft · Windows

Published 2019-10-12 · Updated 2025-04-08 · CVE-2019-1458

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. This vulnerability was exploited by the APT Antlion group in a campaign of cyber espionage against financial and manufacturing companies in Taiwan from 2020 to 2021. The group used a custom backdoor called xPack, which is a .NET loader that extracts and executes encrypted AES payloads, to remain undetected and gain extensive access to the victims' networks for up to 18 months. The vulnerability was used to elevate privileges in the system and launch the xPack backdoor, which allowed the attackers to remotely execute WMI commands, use EternalBlue exploits, and connect to shared resources via SMB to transfer data to their command and control server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-00578

CVE-2019-1458

Affected Products

Windows

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb · Exploit
• 🔥 https://github.com/piotrflorczyk/cve-2019-1458_POC · Exploit
• 🔥 https://github.com/unamer/CVE-2019-1458 · Exploit
• 🔥 https://github.com/rip1s/CVE-2019-1458 · Exploit
• 🔥 https://exploit-db.com/exploits/48180 · Exploit
• 🔥 http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Local-Privilege-Escalation.html · Exploit
• 🔥 http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1458 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/640463 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-1458 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00578 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1458 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1458 · Security Note
• https://t.me/avleonovcom/810 · Telegram Post