> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits/cve-2020-0668.md).
# CVE-2020-0668
## Context
This vulnerability exploits Windows Service Tracing to allow arbitrary file moves. For context, Windows Service Tracing is for troubleshooting services and modules by generating debug data. The parameters are configurable via the Windows registry.
Attackers can set a custom `MaxFileSize` value smaller than the size of the file. This'll prompt the log file, `EXAMPLE.LOG` to be renamed to `EXAMPLE.OLD`. Under-the-hood this is inherently just a file move, where we are effectively moving `EXAMPLE.LOG` to `EXAMPLE.OLD`. Note that the move is performed by `NT AUTHORITY\SYSTEM`.
If you'd like to read more about this vulnerability and exploit, please see [itm4n's blog](https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/) and the [exploit repository](https://github.com/RedCursorSecurityConsulting/CVE-2020-0668).
## Attack
What can I do with an arbitrary file move? Suppose there is a service that runs as SYSTEM. I could overwrite the service binary with a reverse shell or utilize some other vulnerability such as [UsoDLLLoader](https://github.com/itm4n/UsoDllLoader) or [DiagHub](https://github.com/xct/diaghub). Suppose I want to move a file of my choosing into `C:\Windows\System32`. I could create a symbolic link from `C:\EXAMPLE.LOG` to `C:\Tools\revshell.exe`. Then I could create a symbolic link from `C:\EXAMPLE.OLD` to `C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe`. Then upon running the service we'll get a shell as SYSTEM.
## Resources
*
*