Hacker Discloses New Windows Zero-Day Exploit On Twitter

SandboxEscaper posted^[2]
a link to a Github page hosting a proof-of-concept (PoC) exploit
for the vulnerability that appears to be a privilege escalation
flaw residing in Microsoft Data Sharing (dssvc.dll).

The Data Sharing Service is a local service that runs as
LocalSystem account with extensive privileges and provides data
brokering between applications.

The flaw could allow a low-privileged attacker to elevate their
privileges on a target system, though the PoC exploit code
(deletebug.exe) released by the researcher only allows a low
privileged user to delete critical system files—that otherwise
would only be possible via admin level privileges.

The PoC exploit has successfully been tested against
“fully-patched Windows 10 system” with the latest
October 2018
security updates, Server 2016 and Server 2019, but we do not
recommend you to run the PoC, as it could crash your operating
system.
^[3][4]

This is the second time in less than two months SandboxEscaper has
leaked a Windows zero-day vulnerability.

In late August, the researcher exposed details and PoC exploit
for a local privilege escalation vulnerability in Microsoft Windows
Task Scheduler occurred due to errors in the handling of the
Advanced Local Procedure Call (ALPC) service.

Shortly after the PoC released for the previous Windows zero-day
flaw, the exploit was found actively being exploited in the
wild, before Microsoft addressed the issue in the September 2018
Security Patch Tuesday^[5]
Updates.

SandboxEscaper’s irresponsible disclosure once again has left
all Windows users vulnerable to the hackers until the next month’s
security Patch Tuesday, which is scheduled for November 13,
2018.

^[1]