Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
summary
Framework targets ALPC interfaces and other RPC paths, uses RPC Viewer to export interfaces, IDA Pro for triage and a hotpatched Process Monitor turned into a command‑line detector to catch SetSecurity/CreateFile/SetFileDisposition calls, then automates UI interactions across many VMs to trigger services. It reproduces impersonation and TOCTOU races via hardlink hijack and symlink replacement, finds multiple exploitable file privilege escalations (FX Dev, Standard Collector, Windows Defender), and successfully reports several bugs to MSRC.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:53About the talk
- 2:11Agenda
- 2:27Logical Privileges
- 2:50System Service Operations
- 3:18Protocol Sequences
- 3:36LPC Interfaces
- 4:38LowHanging Fruits
- 5:00Case Study 1
- 5:20STL
- 5:51System Token
- 6:04Process
- 6:21How it will exploit
- 6:42Installer Service
- 9:21Function List
- 9:42New Bag
- 12:33Testing
- 13:57Repair
- 15:01Sand Art
- 15:31Canvas Users Token
- 16:42Virus Removal
- 17:25System Service
- 19:37Jim Salvaggio
related talks
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
56m"Easy LPEs and Common Software Vulnerabilities"
42mThe Rise of Potatoes: Privilege Escalations in Windows Services
44mwhoami priv - show me your privileges and I will lead you to SYSTEM
29mAbusing WCF Endpoint for RCE and Privilege Escalation
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
56mD1T2 - Attacking Microsoft’s .NET Framework Through CLR
46mFor The Win: The Art Of The Windows Kernel Fuzzing