PPLdump Is Dead. Long Live PPLdump!
summary
Demonstrates a new chain that achieves arbitrary code execution inside PPL processes on Windows 11 by combining a cloud filter rehydration callback, loopback SMB symlink, an oplock to freeze dll loads, and system-wide working set eviction to force paged-in bait‑and‑switch pages; the PoC called PPLfault injects position‑independent payload into services.exe as winTCB‑lite and successfully dumps LSASS. A follow‑on chain (GodFault) uses an anti‑user hard error exploit to open physical memory. A kernel driver mitigation (noFault) blocks remote image paging and the researcher reports MSRC delays after September disclosure.
AI-written summary · about
chapters (8)
- 0:00PPLdump introduction
- 2:27Protected processes and PPL
- 5:12Attacks on PPL
- 11:51PPL code execution research
- 20:58PPLfault exploit demo
- 23:26Godfault exploit chain
- 25:32PPL mitigations response
- 27:56Conclusion
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
34mLPEPM - Tricking Microsoft EPM To Do Our Bidding
25mData-Only Pwning Microsoft Windows Kernel
56m"Easy LPEs and Common Software Vulnerabilities"
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
52mA New CVE-2015-0057 Exploit Technology
28mComplexity Killed Security