Loading vulnerability…
CVE-2020-0787 is a local elevation of privilege vulnerability in the Windows Background Intelligent Transfer Service (BITS). The flaw arises because BITS improperly handles symbolic links, allowing a local attacker to abuse link resolution during privileged file operations. By crafting a suitable symbolic-link-based condition, an attacker who already has code execution on the target host can cause BITS to operate on attacker-controlled targets in an unintended way and elevate privileges. Public reporting describes this as a logical, non-memory-corruption vulnerability and notes that successful exploitation can result in arbitrary code execution with SYSTEM-level privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module implementing a local privilege escalation exploit for CVE-2020-0787, targeting Windows 10 and Windows Server 2016 and later. The exploit abuses an arbitrary file move vulnerability in the Background Intelligent Transfer Service (BITS) to overwrite the system DLL 'C:\Windows\System32\WindowsCoreDeviceInfo.dll' with a malicious DLL generated by Metasploit. The Update Session Orchestrator service is then triggered to load the malicious DLL, resulting in code execution as SYSTEM. The module is weaponized, supporting customizable payloads (such as Meterpreter) and includes cleanup routines. The exploit requires a Meterpreter session on a vulnerable system and is only effective on Windows 10/Server 2016+ where the Update Session Orchestrator service is present. The main fingerprintable endpoint is the system DLL path that is overwritten. The code is well-structured, leverages multiple Metasploit mixins, and provides options for controlling DLL overwrite and job timing.
This repository contains a C++ exploit for CVE-2020-0787, a vulnerability in the Microsoft Windows Background Intelligent Transfer Service (BITS) that allows for arbitrary file move operations with SYSTEM privileges. The exploit is structured as a Visual Studio solution with three main projects: BitsArbitraryFileMove (core logic), BitsArbitraryFileMoveExploit (exploit entry point), and CommonUtils (utility functions for file and symlink manipulation). The exploit works by creating a workspace with specific directories and files, setting up mount points and symlinks, and abusing BITS jobs to move an attacker-controlled file (such as a DLL) into a protected system directory (e.g., C:\Windows\System32). This can be used for privilege escalation or arbitrary code execution as SYSTEM. The README provides usage examples, including executing arbitrary commands via named pipes and running a payload executable. The code is operational and provides a working exploit chain for local privilege escalation on Windows systems vulnerable to CVE-2020-0787.
This repository implements a local privilege escalation exploit for CVE-2020-0787, targeting all supported versions of Microsoft Windows. The exploit leverages the Background Intelligent Transfer Service (BITS) and a series of mount point and symbolic link manipulations to move an attacker-controlled file (such as a DLL) into a protected directory (e.g., C:\Windows\System32) with SYSTEM privileges. The repository is structured as a Visual Studio solution with three main projects: the core exploit logic (BitsArbitraryFileMove), a utility library (CommonUtils), and an exploit runner (BitsArbitraryFileMoveExploit). The exploit works by preparing a workspace, creating mount points and symlinks, setting oplocks, and manipulating BITS jobs to achieve the file move as SYSTEM. The code is written in C++ and is operational, providing a working exploit chain rather than just a proof of concept. The main entry points are BitsArbitraryFileMove.cpp and BitsArbitraryFileMoveExploit.cpp. The exploit requires local access and sufficient privileges to create directories and symlinks, and it targets the Windows platform broadly. No network endpoints are involved; all actions are performed locally on the filesystem and via Windows internal object manager paths.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows local privilege escalation vulnerability used by Makop operators to gain elevated privileges during intrusions.
A proof-of-concept exploit sample for CVE-2020-0787 is mentioned as one payload unpacked from the Krypton crypter.
A Windows Background Intelligent Transfer Service (BITS) local privilege escalation vulnerability (CVE-2020-0787) that can be exploited to execute arbitrary files with elevated privileges; in this reporting it is leveraged via the SOURBITS exploit utility during UNC2198 intrusions.
A Windows local privilege escalation vulnerability mentioned as a recent logical vulnerability exploited by PlayBit, without further technical detail in the article.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.