Finally the shell pops! Found arb dir deletion vuln, coupled with previous method everything lines up and i see attached pic. I need a break from exploitaiton soon- and deserve it.pic.twitter.com/4LF8BNeRDn
Show this thread
-
yes bro, we can lockscreen bypass using arb dir create bug via sub-processes of logonui.exe. When we go to lockscreen and then logonui.exe runas system and when we click such as narrator, magnifier, ...etc which from ease of access are also run as SYSTEM.
I was referring to https://twitter.com/i/status/1240917568870731776 … where i made narrator.exe.local route public. I initially first used it for my lock screen bypass exploit where i bypass lock screen without any credentials from powered off state.
-
-
It's cool bro.
-
But I prefer wermgr route because I can trigger that over COM programmatic without going to lock screen.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.