{"uuid": "c8489d15-7117-43a6-892a-6f707f0d8af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5617", "type": "published-proof-of-concept", "source": "https://t.me/cissp/1064", "content": "CVE-2020-5617.\nSKYSEA is a suite of software developed by Sky Co., LTD. It can monitor and take strong control over activities of employees\u2019 PCs including web browsing histories, file accesses, and attached devices. It\u2019s exclusively sold in Japan and also known by the fact that it\u2019s been abused by \u201cTick\u201d China APT group.\nHe got a copy of this (aptly called) \u201clegit\u201d Trojan and decided to take a look. As a result, found an arbitrary NULL write vulnerability in a Kernel driver that leads to a local privilege escalation. describe how exploited it in detail.\n\nCVE-2020-5617:\nSKYSEA Client View (ver.12.200.12n - 15.210.05f) vulnerable to privilege escalation (PoC)\nhttps://acru3l.github.io/2020/08/03/exploiting-activity-monitor-driver/\nPoC Exploit:\nhttps://github.com/acru3l/PoC/tree/master/CVE-2020-5617", "creation_timestamp": "2026-09-13T00:00:59.930751Z"}