Here's a promised write-up of Windows Privilege Elevation bug that I've discovered / CVE-2021-26415
https://www.cloaked.pl/2021/04/cve-2021-26415/ …
#security #EOP #LPE #bugbountypic.twitter.com/VJzEcXw4tu
suggestions: can you inject delete character to gain more control over data? tried: edges updater? opens ini in root`? tried win.ini ? https://twitter.com/jonasLyk/status/1374961171342708736 … that trick can send all impersonating file opens one way- not, another
-
-
So is this another way of tricking a file open from anywhere on the system to somewhere you can control by redirecting the Global object back to RPC Control? Then creating another symlink to somewhere else?
-
instead of seperatng by open count- i seperate by identity
End of conversation
New conversation -
-
-
The del character didn't work, although I'm not sure I tried to edit raw file. Will have to try.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.