Again, massive, huge credit to @tiraniddo, his DotNetToJScript tool, his teaching .NET to me. Also greetz to @subTee and @mattifestation.
When life gives u 3 "not a security boundary" bugs, combine them. Thx to @tiraniddo & 2 old tricks (if u read my slides): non-Admin TCB PPL.pic.twitter.com/9R5Yn83EVZ
-
-
-
Yup! If there's something I learned in the last year or so it'd be always checking w/ James before making conclusion on your finding!:-)
End of conversation
New conversation -
-
-
non-admin tcb PPL!?!? Mind == blown
-
When a TCB PPL reads from HKCU, whatcha gonna do?
-
Welp. It's not a security boundary... despite products taking dependencies on PPL.
-
Yeah this makes your malware unstoppable without being admin. Not even Defender ATP can touch it since it’s only running at Win not WinTCB.
-
Won't fix. Reason:
-
It’s sad because back when different people were around, they’d push for PPL issues to be fixed. A bunch of mine did, even at high cost.
- 1 more reply
New conversation -
-
-
I used C# to bypass code integrity rules in my PowerShell exploit, by calling Win32 APIs to make executable memory. Similar?
-
jscript->.NET->C yep.
End of conversation
New conversation -
-
-
Jesus what is that thing?
-
Pretty much the end of PPLs serving any use if the boundary won't be serviced (as per James' bug).
-
PPL is a security boundary.
End of conversation
New conversation -
-
-
Bangkok bro, don't be holding out like this.
Thanks. Twitter will use this to make your timeline better. Undo
-
-
-
I had no idea what this meant, except new nasty. Luckily I invested in Windows Int 7Ed and now I know! Thx Alex and co for writing it!
Thanks. Twitter will use this to make your timeline better. Undo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.