The Hidden Risk in Undocumented API Behavior

on YouTube ↗36m

" summary

Finds an undocumented Win32/registry behavior where common delete APIs follow registry symbolic links and delete the target not the link, forcing use of the undocumented NtDeleteKey and correct REG_OPTION_OPEN_LINK to remove links safely. Uses AccessChk and registry viewers, creates a symlink to CURRENT_USER\Software\Policies, triggers AV/EDR remediation (quick scan) to delete the policies key, sets AlwaysInstallElevated to escalate a standard user to SYSTEM, and tests 18 vendors—16 were initially vulnerable and later patched.

AI-written summary · about

" chapters (15)

1. 0:00Intro
2. 0:22Session Outline
3. 1:31(Symbolic) Links in Windows
4. 2:50Registry Symbolic Links
5. 5:00Creating Registry Symlink: issue #3
6. 5:57Deleting Registry Symlink
7. 8:13Documentation of Links Deletion
8. 10:30Vulnerability: WYSINWYD
9. 12:26An Industry Failure?
10. 13:43Read-Only Registry Keys
11. 17:05Risk #1: Some Interesting Policies
12. 18:36Risk #1: Attack Vector (Diagram)
13. 24:22Risk #2: Attack Vector (Diagram)
14. 26:25Security Impact
15. 28:44Mitigation / Microsoft

" related talks

• 49mThe Hidden Risk in Undocumented API BehaviorBahaa Naamneh · NDC Security 2024
• 50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10Wenxu Wu, Shi Qin · HITBSecConf 2019 Amsterdam
• 48m"Sneaking Past Device Guard"Philip Tsukerman · CONFidence 2019
• 51mSneaking Past Device GuardPhilip Tsukerman · HITBSecConf 2019 Amsterdam
• 33mAikido: Turning EDRs to Malicious Wipers Using 0-day ExploitsOr Yair · Black Hat Europe 2022
• 29mRendering Ransomware Detection and EDR Products BlindRene Kolga · BSidesSLC 2020
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 40mBeyond Living-Off-the-Land: Why XP Exploits Still MatterJean-Ian Boutin, Zuzana Hromcova · RSAC 2021