Haidar
@haider_kabibo • 1,174 subscribers
Wine tester at Kaspersky :) Personal account. Does not reflect my employer
Videos
RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.
Haidar13,483 次观看 • 11 天前
So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato
Haidar51,435 次观看 • 4 个月前
没有更多内容可加载