CDPSvc DLL Hijacking - From LOCAL SERVICE to SYSTEM

A DLL hijacking “vulnerability” in the CDPSvc service was reported to Microsoft at least two times this year. As per their policy though, DLL planting issues that fall into the category of PATH dir...

Dec 11, 2019 Privilege Escalation

Give Me Back My Privileges! Please?

I want to tell you the story of a service account which lost all its powers (a.k.a. privileges). Windows world is getting increasingly ruthless and when the system considers you are not worthy, thi...

Dec 5, 2019 Privilege Escalation

Weaponizing Privileged File Writes with the USO Service - Part 2/2

In the previous post, I showed how the USO client could be used to interact with the USO service and thus have it load the windowscoredeviceinfo.dll DLL on demand with the StartScan option. I wasn’...

Aug 19, 2019 Privilege Escalation

Weaponizing Privileged File Writes with the USO Service - Part 1/2

The DiagHub DLL loading technique found by James Forshaw (a.k.a. @tiraniddo) has become very famous. Whenever you found an arbitrary file write as SYSTEM in Windows or in some third-party software,...

Aug 17, 2019 Privilege Escalation

Windows Privilege Escalation - DLL Proxying

DLL Hijacking is the first Windows privilege escalation technique I worked on as a junior pentester, with the IKEEXT service on Windows 7 (or Windows Server 2008 R2). Here, I’d like to discuss one ...

Apr 18, 2019 Privilege Escalation

VBA RunPE - Breaking Out of Highly Constrained Desktop Environments - Part 2/2

In the previous part, I discussed the method used by Didier Stevens to run cmd.exe within Excel (or Word) thanks to a custom shellcode in VBA. I also outlined its limitations. In this part, I’ll tr...

Dec 29, 2018 Defense Evasion

VBA RunPE - Breaking Out of Highly Constrained Desktop Environments - Part 1/2

In this post, I’d like to share a technique that I often use to break out of highly constrained desktop environments such as CItrix. The only prerequisite is to have access to Microsoft Word or Exc...

Dec 12, 2018 Defense Evasion

CVE-2019-19544 - CA Dollar Universe 5.3.3 'uxdqmsrv' - Privilege Escalation via a Vulnerable SUID Binary

A vulnerability was discovered in the uxdqmsrv binary. It consists in an arbitrary file write as root that can be leveraged by any local user to gain full root privileges on the host (UNIX/Linux on...

Sep 3, 2018 Privilege Escalation

CVE-2017-13130 - BMC Patrol 'mcmnm' - Privilege Escalation via a Vulnerable SUID Binary

A vulnerability was discovered in the mcmnm binary. It is compiled with a RPATH starting with .:. Therefore, any user can craft a malicious library (e.g.: libmcmclnx.so) and then run mcmnm from the...

Jun 6, 2018 Privilege Escalation