Abstract

0-day is the silver bullet for APT (Advanced Persistent Threat). By studying 0-day exploits which were captured in the wild, we may be able to infer the capabilities and tendentiousness of real-world attackers. In August 2020 Windows Security Update, Microsoft patched some in the wild 0-day exploits. It is revealed that attackers used one vulnerability in Internet Explorer to get remote code execution and chained with another vulnerability in splwow64 to get privilege escalation. By analyzing the two vulnerabilities, I reproduced the full exploit chain successfully and discovered some similar vulnerabilities which maybe has been exploited by real-world attackers already.

This topic presents the root cause analysis of the two vulnerabilities, shows how to reproduce the full exploit chain and discloses the details of some similar vulnerabilities I found by studying 0-day in the wild.