Automated Discovery Of Logical Priv. Esc. Bugs In Win10
summary
An automated system simulates UI actions and invokes exposed interfaces to trigger and validate logical privilege-escalation patterns in Windows 10 services, discovers an ALPC local privilege escalation by exploiting incorrect impersonation and TOCTOU, and uses reparse-point tricks (creating junction/symbolic link reparse trick and swapping targets during checks via ReadDirectoryChangesW or DeviceIoControl) to escalate. Automation combines an IDA Pro plugin to identify risky functions, runtime monitors for SetFileSecurity-like operations, and finds three new vulnerabilities in one week.
AI-written summary · about
chapters (10)
- 0:00Introduction to research
- 1:50Logical bugs in Windows
- 3:53Case studies of vulnerabilities
- 8:53Reparse points and links
- 14:03Opening files and redirects
- 24:34Race condition exploitation
- 29:07Automated bug discovery
- 34:03UI-based fuzzing framework
- 39:35Exploit development workflow
- 46:16Execution and conclusion
related talks
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
56m"Easy LPEs and Common Software Vulnerabilities"
44mwhoami priv - show me your privileges and I will lead you to SYSTEM
42mThe Rise of Potatoes: Privilege Escalations in Windows Services
34mLPEPM - Tricking Microsoft EPM To Do Our Bidding
48m"Sneaking Past Device Guard"
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home