Digging for IE11 Sandbox Escapes Part 1
summary
Describes discovery of 4 sandbox escapes in IE11 during a 30‑day bug bounty, with working exploit chains that use COM brokers, registry symbolic links and NT junctions to escalate from AppContainer/EPM to user level. Shows live debugging with Process Monitor and IDA, a DLL injector + PowerShell tools to run tests, and reproducer/source code on GitHub; exploits writeable keys/dirs (temp, Flash profile) to drop startup payloads on Windows 8.1.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:47Tools and Setup
- 3:06IE Protected Mode
- 13:43Elevation Policy Types
- 16:40Potential Attack Surface
- 35:28Searching for Accessible Resources
- 39:11Exploitation of Accessible Resources
- 44:16Finding a Target key
- 44:54Exploitation: Step 2
- 46:12Exploitation: Step 5
related talks
44mCutting Edge: Microsoft Browser Security — From People Who Owned It
49m$Hell on Earth: From Browser to System Compromise
49mChrome Browser Exploitation: from zero to heap sandbox escape
45mThe Windows Sandbox Paradox
58msandboxes: no thy limit
56m"Easy LPEs and Common Software Vulnerabilities"
36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"
41mXSS Horror Show