The Next Generation of Windows Exploitation: Attacking the Common Log File System
summary
Research on the Windows Common Log File System discovers parsing and error‑handling bugs in BLF structures, including CVE-2022-21916 (control record index OOB at BLF offset 0x70) and a CLFS owner-page pool overflow that corrupts WF headers with a page size of 0x1000. Targeted fuzzing bypasses BLF CRC and triggers crashes; the exploitation chain builds an arbitrary read/write primitive by corrupting ALPC handle/result tables and message extension buffers, using WNF spraying, NTDeleteWnfState holes and crafted CreateLogFile traffic to overwrite a token pointer and obtain SYSTEM.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:59Agenda
- 1:26What Is Common Log File System
- 6:01Summary
- 6:39Vulnerability Is Related to the Clfs Control Record Structure
- 10:46Pro Overflow Exploitation Methods
- 17:57Create the Owner Page
related talks
44mDeathNote of Microsoft Windows Kernel
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
44mAnatomy and Defense of LOTL Fileless Intrusions
46mFor The Win: The Art Of The Windows Kernel Fuzzing
52mA New CVE-2015-0057 Exploit Technology
30mPPLdump Is Dead. Long Live PPLdump!
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
25mData-Only Pwning Microsoft Windows Kernel