offensive security - windows internals | BlueSky: https://xitter.cf/t.co/ytvJCoaF2c | Mastodon: https://xitter.cf/t.co/hNIHa6L14d
Italy
Joined August 2016
- Tweets1.8K
- Following324
- Followers9.3K
- Likes2.6K
There is also another check later in IopQueryRegistryKeySystemPath that ensures the ImagePath is under the "System" key 👇
It's no secret anymore that Twitter has changed since Elon took over, and X is very different from the previous Twitter.
Even though today it still remains my main source of information and content related to infosec, i’m exploring other platforms to diversify where i share and engage.
I have created a new BlueSky account and revived my old Mastodon account to see how these platforms compare.
BlueSky 👉 bsky.app/profile/splintercod…
Mastodon 👉 infosec.exchange/@splinter_c…
I’m still here, and i will be cross-posting as i figure out where the best conversations happen. Let’s connect and stay in touch and see how these platforms grow and evolve. Maybe one day can become some good replacement :D
The side effect of this is that you still get a full admin token when admin protection is enabled and you perform a non-interactive LogonUser() with an explicit password. So you can still get around UAC with RunasCs even when admin protection is on 👇
cc @decoder_it
What we don't get about new Windows feature "Administrator Protection": Why can a regular user, member of local admins, still obtain a high IL token when accounts are supposed to be split between regular and _admin user? cc @splinter_code
The Administrator Protection would mitigate most known UAC bypasses that exploit auto elevated binaries or interfaces, yet token manipulations still gets through 💪
It has been announced recently by Microsoft and it just landed on latest insider build —> blogs.windows.com/windows-in…
Great talk by my friend @decoder_it at Troopers 🔥
10 Years of Windows Privilege Escalation that includes the last iteration of the Potato exploits. Worth a watch! 👇
youtube.com/watch?v=rPZx1zbK…