{"id":80,"date":"2021-01-19T21:42:00","date_gmt":"2021-01-19T21:42:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=80"},"modified":"2025-12-13T21:43:00","modified_gmt":"2025-12-13T21:43:00","slug":"blaster-cve-2019-1388-tryhackme-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=80","title":{"rendered":"Blaster CVE-2019-1388- Tryhackme lab"},"content":{"rendered":"<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/Screen-Shot-2021-01-17-at-10.29.32-PM-1024x757.png\" alt=\"\" class=\"wp-image-4647\" style=\"width:489px;height:360px\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">This post will show how easy it is to get a system level command prompt with a standard user account using the CVE-2019-1388 vulnerability.<\/p>\n\n\n\n<p class=\"has-text-align-center\">This is demonstrated by working on the Blaster room by <a href=\"https:\/\/tryhackme.com\">TryHackMe<\/a>. This challenge highlights the CVE-2019-1388 vulnerability. The standard user will run an executable that required administrator privileges. Next the user will click &#8220;Show more details&#8221;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/1-1.png\" alt=\"\" class=\"wp-image-4640\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">Next the user will click &#8220;Show information about the publishers certificate&#8221;. Followed by the &#8220;VeriSign Commercial Software Publishers CA&#8221; link.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/2.png\" alt=\"\" class=\"wp-image-4641\"\/><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/3.png\" alt=\"\" class=\"wp-image-4642\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">This will open Internet Explorer, the problem here is; the <strong>Internet Explorer program opens with administrative privileges<\/strong>. If we click &#8220;Control + s&#8221; we will get the error below, then a file browser with administrator privileges.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/4.png\" alt=\"\" class=\"wp-image-4643\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">If we close the error and type <strong>&#8220;cmd&#8221;<\/strong> in the top, we get a command prompt window.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/5.png\" alt=\"\" class=\"wp-image-4644\"\/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">In the command prompt window, we run the <strong>&#8220;whoami&#8221;<\/strong> command to display the prompt has system level privileges.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/01\/6.png\" alt=\"\" class=\"wp-image-4645\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">This process bypassed UAC and provided a system level command prompt without entering an administrator password. This vulnerability was quickly patched by Microsoft and hopefully not too common in modern systems with patch management. <strong>Please keep your systems up to date!<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This post will show how easy it is to get a system level command prompt with a standard user account using the CVE-2019-1388 vulnerability. This is demonstrated by working on the Blaster room by TryHackMe. This challenge highlights the CVE-2019-1388 vulnerability. The standard user will run an executable that required [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-80","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/80","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=80"}],"version-history":[{"count":1,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/80\/revisions"}],"predecessor-version":[{"id":81,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/80\/revisions\/81"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=80"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=80"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=80"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}