PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Local Privilege Escalation

ID EDB-ID:41605
Type exploitdb
Reporter Exploit-DB
Modified 2017-03-15T00:00:00


PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Local Privilege Escalation. Local exploit for Windows platform

                                            #Exploit Title: PCAUSA Rawether for Windows local privilege escalation
#Date: 2017-03-15
#Exploit Author: ReWolf
#Vendor Homepage: original vendor website doesn't exist anymore
#Version: too many
#Tested on: Windows 10 x64 (TH2, RS1)

Rawether for Windows is a framework that facilitates communication between an application and the NDIS miniport driver. It’s produced by a company named Printing Communications Assoc., Inc. (PCAUSA), which seems to be no longer operating. Company websites can be still reached through web.archive.org:


Rawether framework provides NDIS Protocol Driver similar to the NPF.SYS (part of the WinPcap). This framework is used by many different hardware vendors in their WiFi and router control applications. Exploit attached to this advisory targets 64bit version of PcaSp60.sys driver which is part of ASUS PCE-AC56 WLAN Card Utilities.

More information:
- http://blog.rewolf.pl/blog/?p=1778
- https://github.com/rwfpl/rewolf-pcausa-exploit/tree/4045cd9b45d647430d779f5b0a018a7a11d6ca2a