Microsoft Windows AppXsvc Deployment Extension Privilege Escalation

`# Exploit Title: Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation  
# Date: 2019-11-22  
# Exploit Author: Abdelhamid Naceri  
# Vendor Homepage: www.microsoft.com  
# Tested on: Windows 10 1903  
# CVE : CVE-2019-1385  
  
  
Windows: "AppX Deployment Service" (AppXSVC) elevation of privilege vulnerability  
  
Class: Local Elevation of Privileges  
  
Description:  
This Poc is exploiting a vulnerability in (AppXSvc) , abusing this vulnerability   
could allow an attacker to overwrite\create file as SYSTEM which can result in EOP .  
The're is 2 way to abuse the issue .  
Step To Reproduce :  
[1] For An Arbitrary File Creation  
1-Turn %userprofile%\AppData\Local\Microsoft\WindowsApps\Backup Into a Junction To  
your target directory example "c:\"  
2-Open Powershell and execute the command Add-AppxPackage -RegisterByFamilyName -ForceApplicationShutdown -MainPackage Microsoft.MicrosoftEdge_8wekyb3d8bbwe  
3-Check the directory the file should be created now  
4-Enjoy:)  
[2] To Overwrite File   
1-Create a temp dir in %temp%\  
2-Create a hardlink to your target file in the temp created dir  
3-Turn %userprofile%\AppData\Local\Microsoft\WindowsApps\Backup Into a junction to  
your temp created dir  
4-Open Powershell and execute the command Add-AppxPackage -RegisterByFamilyName -ForceApplicationShutdown -MainPackage Microsoft.MicrosoftEdge_8wekyb3d8bbwe  
5-Check the file again  
Limitation :  
when 'MicrosoftEdge.exe' is created it would inherit the directory permission which  
mean the file wouldnt be writtable in majority of cases but a simple example of   
abusement in the directory "c:\" <- the default acl is preventing Athenticated Users  
from creating file but not modifying them so if we abused the vulnerability in "c:\"  
we will have an arbitrary file created and also writeable from a normal user .  
also you cant overwrite file that are not writable by SYSTEM , i didnt make a check  
in the poc because in if the file is non readable by the current user the check will  
return false even if the file is writtable by SYSTEM . NOTE : you can also overwrite  
file which you cant even read them .  
In the file creation make sure the path is writtable by SYSTEM otherwise the poc will  
fail . I think 99% of folders are writtable by SYSTEM  
Platform:  
This has been tested on a fully patched system (latest patch -> November 2019) :  
OS Edition: Microsoft Windows 10 Home  
Os Version: 1903  
OS Version Info: 18362.418  
  
Additional Info  
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuldLabEx = 18362.1.amd64fre.19h1_release.190318-1202  
  
  
Expected result:  
The Deployment Process should fail with "ERROR_ACCESS_IS_DENIED"  
Observed result :  
The Deployment Process is overwritting or creating an arbitrary file as   
"LOCAL SYSTEM"  
  
NOTE : It was patched on 7/11/19  
`