{"uuid": "e8e5c510-4b0f-45c8-9c36-fa1667ba4b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0787", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"itm4n\", \"gwillcox-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2020-0787, an arbitrary file move vulnerability in outdated versions of the\\n          Background Intelligent Transfer Service (BITS), to overwrite C:\\\\Windows\\\\System32\\\\WindowsCoreDeviceInfo.dll\\n          with a malicious DLL containing the attacker's payload.\\n\\n          To achieve code execution as the SYSTEM user, the Update Session Orchestrator service is then started, which\\n          will result in the malicious WindowsCoreDeviceInfo.dll being run with SYSTEM privileges due to a DLL hijacking\\n          issue within the Update Session Orchestrator Service.\\n\\n          Note that presently this module only works on Windows 10 and Windows Server 2016 and later as the\\n          Update Session Orchestrator Service was only introduced in Windows 10. Note that only Windows 10 has been tested,\\n          so your mileage may vary on Windows Server 2016 and later.\", \"disclosure_date\": \"2020-03-10\", \"fullname\": \"exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/local/cve_2020_0787_bits_arbitrary_file_move\", \"references\": [\"CVE-2020-0787\", \"URL-https://itm4n.github.io/cve-2020-0787-windows-bits-eop/\", \"URL-https://github.com/itm4n/BitsArbitraryFileMove\", \"URL-https://attackerkb.com/assessments/e61cfec0-d766-4e7e-89f7-5aad2460afb8\", \"URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html\", \"URL-https://itm4n.github.io/usodllloader-part1/\", \"URL-https://itm4n.github.io/usodllloader-part2/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows DLL Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:07.816882Z"}