Digging for IE11 Sandbox Escapes Part 2
summary
Claims four concrete sandbox escapes found in a 30-day bounty, with sample source on GitHub and all now patched. Demonstrates reading the elevation policy to launch COM servers, a NET GetType pivot using the _object interface to call Process.Start, an object teleportation technique that serializes an XML DOM into the higher-privileged broker to execute JavaScript, and an ActiveX installer double-quote path injection that injects command-line arguments. Uses Visual Studio, IDA Pro, Reflector, Windbg and DebugView; builds working exploits during demos and confirms fixes.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:11Security in Elevation Policy
- 1:48Default Applications
- 3:55COM Elevation Policy
- 5:22NET Deployment Service (DFSVC)
- 7:52MSCORLIB Type Library
- 9:22Exploiting The Vulnerability
- 12:11IEUserBroker Interface
- 13:45Shell Document View Broker
- 14:19IE Recovery Store
- 15:17Built-in Implementations
- 16:55Attacking Out Of Process Storage
- 22:44Supported Interfaces
- 24:32Complex Interface
- 25:18Installing an ActiveX Control
- 26:02Prompt Bypass
- 27:33Calling Sequence
- 28:17Executing Our Own Code
related talks
44mCutting Edge: Microsoft Browser Security — From People Who Owned It
40mMarkDoom: How I Hacked Every Major IDE in 2 Weeks
45mThe Windows Sandbox Paradox
49mChrome Browser Exploitation: from zero to heap sandbox escape
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
41mXSS Horror Show
43mHunting for Bugs, Catching Dragons
58msandboxes: no thy limit