although this privesc bug was fixed (denied std priv user), an entry like below can be created by a local admin to persist a program (every time usosvc starts) https://github.com/irsl/CVE-2020-1313 …pic.twitter.com/xLVaDJDxmz
is that detection of abusing when the service do a unsafe dll load of a not existing file from all path entries?
-
-
-
Oh- allright , it also attempts to load a not existing dll from path , we used that in the .net core priv esc
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.