LPEPM - Tricking Microsoft EPM To Do Our Bidding
summary
Workable local privilege escalation against Microsoft EPM that turns any allowed rule into an admin execution by exploiting a double-fetch TOCTOU in the service: hash is computed, file is swapped, then CreateProcess runs under a just-in-time virtual account giving an elevated shell. A robust bypass uses a cloud filter hydration trick (placeholder files / OneDrive-style callbacks) to feed benign bits during hashing and malicious bits at process creation; demo yields SYSTEM-equivalent admin shells. Windows 24H2 blocks the executable image case, but installers/PowerShell rules remain exploitable; Microsoft issues partial fixes and documentation changes, no CVE assigned.
AI-written summary · about
chapters (15)
- 0:00Introduction and presenters
- 1:08What is EPM and why it exists
- 3:17EPM architecture overview
- 7:12First vulnerability discovery
- 10:27Time of check to time of use bug
- 12:14Exploit demonstration
- 14:24Microsoft's initial patch attempt
- 18:19Revival of the exploit
- 25:15Exploit using cloud sync engine
- 27:00Simpler exploit with PowerShell
- 28:50UNC path and remote path bypass
- 29:33DLL hijacking and MSI handlers
- 30:36Microsoft's response and documentation
- 32:20Recommended security measures
- 33:24Conclusion and Q&A
related talks
56m"Easy LPEs and Common Software Vulnerabilities"
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
30mPPLdump Is Dead. Long Live PPLdump!
58mPrivilege Escalation in Microsoft Azure
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
39mWindows Agentless C2: (Ab)using the MDM Client Stack
48m"Sneaking Past Device Guard"