Replying to
@wdormann@infosec.exchange in https://project-zero.issues.chromium.org/issues/42452400 I hijacked SYSTEM's classes key (which doesn't exist by default) to get arbitrary code exec :D
Remote
James Forshaw 
@tiraniddo@infosec.exchange
mastodon 4.8.0-alpha.3+glitchSecurity researcher in Google Project Zero. Author of Attacking Network Protocols. Tweets are my own etc.
4311 Followers
165 Following
47 Posts
Joined November 04, 2022
Github:
Found another hilariously trivial Windows PPL, hard to believe I didn't see this one earlier. Doesn't work in full PP due to the nature of it, but TBH PPL-WinTCB is really all you need :)
My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D
Replying to
@wdormann@infosec.exchange the "old" way was to try and find a COM object that crashed in a useful way just by being loaded. I've no idea how common that is anymore, let alone if they'd be exploitable on a modern system with current mitigations. Is pretty easy to check, just load every class on the system and see if anything crashes.
Does the method you're using to get the class loaded do anything with it like access its IPersist interface? That at least expands the attack surface.
Boosted by @ferrix@mastodon.online
My final blog related to admin protection is up. https://projectzero.google/2026/02/gphfh-deep-dive.html I go into a bit of history of the interesting GetProcessHandleFromHwnd API, how it ended up allow you to bypass protected process restrictions and how it's now "fixed".
Replying to
@jerry@infosec.exchange the only reason I visited recently was because work was paying and I lived in the SF Bay Area so getting back and forth to LV was easy. Now I'm back in the UK, work can't pay me enough to subject myself to that trip. I don't think you're missing much though.
The new Google office in London is looking nice. https://blog.google/company-news/inside-google/around-the-globe/google-europe/united-kingdom/platform-37-the-ai-exchange/
I especially like how it's super energy efficient and uses low carbon materials while touting the world destroying tech that is AI. A masterclass of green washing.
Released the second part of my blog post series on Admin Protection. This time it's about how most of the bugs I found came about due to abusing UI Access which was overlooked as UAC bypasses because, well, they were UAC bypasses. https://projectzero.google/2026/02/windows-administrator-protection.html
Lolz https://www.synacktiv.com/sites/default/files/inline-images/scroll_of_truth.webp
https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1.html
https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html
I don't know flash card, zero rugby balls? The things we teach children today, sheesh.
Fucks sake, Defender is now signaturing on builds of my v2 version of NtObjectManager, god knows why. I fucking hate MS and Defender especially.
Replying to
@wdormann@infosec.exchange I believe the impersonation is done by the kernel. I abused that a long time ago to get arbitrary file creation e.g. https://project-zero.issues.chromium.org/issues/42452405 surprised (or not) that behavior is still there.
Project Zero have finally got around to updating the blog to something less blogger-esc, check it out at https://projectzero.google. To coincide with this momentous occasion I dug out the draft of my blog post about Windows Object Manager performance which became the basis of my article in PoC||GTFO #13 and updated it to see if it still worked in Windows 11. You can read it at https://projectzero.google/2025/12/windows-exploitation-techniques.html
I've put up the slides from my Zer0Con 2026 presentation on Administrator Protection. https://github.com/tyranid/infosec-presentations/blob/master/Zer0Con/2026/Protecting%20your%20Administrator.pdf
Replying to
@0x00string@infosec.exchange "Chris Anley, the chief scientist at security consulting giant NCC Group, said that asking an AI model to try to exploit a bug is a key step in confirming it’s a real vulnerability worth fixing." Jesus tap dancing Christ. How did we get here?
Replying to
@wdormann oh I see, it passes back a handle. I assumed Defender did something to the file, then the unprivileged process opened the file. And yeah if it passes back a read-only handle then the code can parse out the SAM's contents as everything else needed to decrypt the hashes is accessible without any privileges (bizarre IMO).
No doubt it'd be relatively easy to narrow this down to something simpler as a PoC, perhaps that didn't help their case with MSRC who as you point out have become somewhat lazy in their triage process.
Replying to
@wdormann actually going back it looks to me like Defender makes a copy of the file into a location the user can read, so not passing back a handle.
Also not saying MSRC are in the right in any way, but certainly a super complex PoC combined with not 100% reliability won't have helped. Ideally a simple description should be enough for them but that's now how MSRC operate now. Maybe they can get Project Glasswing to the work for them in the future :)
Replying to
@evilpaul_atebit@icosahedron.website @pcy@icosahedron.website the quote is clearly disingenuous, not just for their ability to modify the client itself (if it was open source and inspectable, like Signal for example they could make a better claim) but also just because something is encrypted doesn't mean it's inaccessible when you control the platform. I'm pretty sure that at least iMessage has the ability to hold multiple "escrow" keys that all messages are encrypted to, which is transparent to the user and so could be deployed surreptitiously. I'd be shocked if WhatsApp doesn't have something similar.
Of course whether they're doing it, is another matter. The risk might be too great, but this is Meta who've not shown much scruples in the past.
@GossiTheDog@cyberplace.social I so dislike going through US immigration. Even with a green card I felt I was one CBP officer's or computer's bad day away from being locked up. I finally decided to give up the greencard once I'd been out for 12 months to give me one less thing to worry about if I have to unfortunately travel there for work. Though no doubt I'll now get questions on why I'd relinquish such a valuable opportunity to become a citizen of the greatest country in the world.
Replying to
@mossmann@mastodon.social at first I thought, no that's not right. But I realized that my pronunciation of Romeo is different between the car brand and the NATO alphabet (as in RoMeo for the car, and RomEo for the alphabet) which confused me massively.
Also fun, is NATO have a quiz on their website, https://www.nato.int/en/about-us/nato-history/history-by-theme/symbols-of-nato/nato-phonetic-alphabet I got 25/26 right, try and guess which one I failed if you go through the quiz yourself :)
@GossiTheDog@cyberplace.social is Mythos going to be the new go to excuse, after no one believed that they were hit by an "Advanced Attacker"?
Replying to
@qdkp @wdormann not sure I agree with the blog posts conclusion that there's no bug. The complex exploit is just using various tricks to make it as reliable as it can but it comes down to defender copying an arbitrary file through a symlink as SYSTEM.
As for the redirection mitigation, god knows why they don't turn it out. It wouldn't shock me if it's some concern that it'll break some enterprise consumer using junctions , or maybe malware could hide itself.
Replying to
@wdormann that's some seriously complex code :) A file redirection attack in the Windows Defender update process I guess?
Of course I’m deeply angry that apple chose to prostate themselves to the ineffectual ofcom who should be spending their time enforcing real laws like against GBNews. But I do wonder what happens now with devices if you log off from your unverified apple account. Does it revert to “normal” operation ? Or with 26.4 will it come up by default in kid mode? Can you use an iPhone anymore without ever signing in?
The new macbook neo looks somewhat cute, but, it doesn't come with a PSU? Really? Is this going to be the new normal going forward for laptops? This seems to at least be the case in the UK, checking the US website it comes with a 20W USB-C PSU.
Replying to
@gsuberland the problem is, fireworks have a nice, nostalgic smell which welcomes in the season. A blown tant, less so.
Seems that the trick I used in https://projectzero.google/2025/01/windows-bug-class-accessing-trapped-com.html by calling ITypeInfo::CreateInstance cross process has been blocked. Sort of.
They've "fixed" it in a bizarre way, there's now a new AppCompat key, which doesn't exist by default. It's HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ITypeInfoCreateInstanceSettings and in that you need a AllowedOutOfProcIIDList REG_MULTI_SZ value which provides the allow list for the CreateInstance call which is checked in the stub function.
However it's not allow listing CLSIDs, it's allow listing the IID you request. I guess the idea is you put a very specific IID in there which only a specific class can satisfy, as if someone puts in IID_IUnknown it all falls apart.
TBH this only really fixes a risk of EoP. It doesn't block the PPL attack vector, at least from admin as they can just modify this key. And I think I have a way of getting it work even without admin ;)
Replying to
@cR0w@infosec.exchange that's because CA is the only state which mandates a hand gun must be dishwasher safe, but due to the gun roster you can only buy 3rd gen so they can't enforce it.
Replying to
@oct0xor that's what caused v1 to be detected. In v2 I tried my best to refactor it until it stopped detecting and have never used it for a PoC since. Still, something must have decided to use it, or Defender is just detecting the use of a native API which happens to be used by malware somewhere.
Replying to
@R41N3RZUF477 yeah I wouldn't send them anything on admin protection right now until the reenable it properly. I am still skeptical that it will be securable long term, but we'll see :)
Replying to
@wdormann I'm not sure the unprivileged process should be able to read the SAM in the VSS though, I assume Defender must be modifying the ACL or something on the file, which is the bug. Not looked at it, and not sure I trust running something that complex to check :D
Replying to
@itm4n@infosec.exchange not looked at it yet. Does it return a process handle to the caller? Also I assume you pass any command line? Perhaps you could abuse something like the COM IRundown interface callback by dumping process memory of a service?
Replying to
@siguza yeah, I am curious if this is just Apple taking advantage/malicious compliance or if this is the new normal and no laptop sold in Europe will have a PSU going forward. Perhaps I wouldn't mind if they at least didn't charge full price for the PSU if you bought it with the laptop.
@lcamtuf@infosec.exchange $700 a week I assume? :)
Currently implementing an airgapped network by adding two network cards to a macbook air and turning on IP forwarding.
Replying to
@R41N3RZUF477@infosec.exchange it doesn't require any special privileges, so I don't think it's a duplicate :)
Replying to
@lcamtuf@infosec.exchange my copy arrived, no idea how it's cheaper than my Windows book but IMO much better bound. Probably better content as well :D
@rupert@mastodon.nz @GossiTheDog@cyberplace.social yeah I'm sure it'll be fine, it was mostly in jest, but you never know. That said, I'm going to do my best to never need to travel there again, which is somewhat hard in the tech industry.
Replying to
@ChrisJohnRiley@infosec.exchange I agree, as someone who has had a greencard they almost certainly know more about me than most. I think if they want this access the EU should just opt out entirely and revoke visa free access for Americans and see how long that lasts. I have no plans to visit the USA any time soon. Then again no idea what the UK would do, probably acquiesce with a shrug.
Replying to
@lcamtuf@infosec.exchange nice. Surprised at how low cost the book is especially printed in colour, much cheaper than my last book :) TBH while the UK postage is a lot it's still pretty cheap in the grand scheme of things and I do like to support No Starch.
Replying to
@itm4n@infosec.exchange I assumed the handle would give you much but thought I’d ask. Certainly would seem you’d be able to do something with the environment. Perhaps override windir or commonprogramfiles and hijack a DLL load?
Replying to
@zzt@mas.to the reason the French workers are so militant is due to the cheap and easy availability of good quality bread. The shitiness of US bread is a plot by the elite to keep the proles in their place.
@0x00string@infosec.exchange they're trying, in the UK I can no longer use "social media" parts of xbox live without verifying my ID. As I have no friends that really doesn't bother me. But I do wonder how long until they do something I do care about. I can apparently play mature content fine, it's only the online aspects, for now.
What's crazy is the MS account is a US one, paid for by a US CC and yet because the xbox is sitting in the UK they apply the stupid rules.