If you have Hyper-V on, good chances you are vulnerable to an easy two-line BSoD that works on the latest version of Windows from a restricted user. P.S it was reported to MSRC.pic.twitter.com/ZsK3Xi6fFy
-
that is interesting for path hijack attacks where a privelegied service for example get redirected by a junction folder dont know if still like this- but last i checked: create %userprofile%\http://ntuser.man junction folder targetting c:\windows\windows\system32\wtf
ok- clfs will append .blf to created file- to bypass create realfilename:wtf - now blf append to the alternative data stream instead
