"Easy LPEs and Common Software Vulnerabilities"
summary
Shows concrete, fast-to-find privilege escalations: uses Process Hacker, Procmon and Project Zero symbolic tools to map IPC and filesystem access, finds a Zoom MSI repair that performs arbitrary folder deletion via junctions, leverages ProgramData\chocolatey in the system PATH for a chocolaty PATH DLL hijack to get SYSTEM code execution, demonstrates Foxit update service parsing a crafted foxitdata.txt to run commands, and finds Puppet/VMware services loading writable DLL/SO paths. Most bugs take under a day to find and exploit.
AI-written summary · about
chapters (11)
- 0:00Introduction to LPEs
- 2:49Goals for fast vulnerability research
- 6:00Logic vulnerabilities overview
- 8:09Common attack surfaces in processes
- 10:15File system redirection risks
- 13:48Zoom privilege escalation demo
- 29:14Foxit Reader logic bug demo
- 35:07Puppet Labs zero day demo
- 41:46VMware workstation vulnerability
- 47:01Key takeaways and future outlook
- 50:11Q&A session
related talks
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
34mLPEPM - Tricking Microsoft EPM To Do Our Bidding
50mPwnie Awards 2016
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
01h 06mHow hacking works
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
32mPicking the Low-Hanging Fruit – Easy Pentest Wins