Felix aka [xi-tauw]

Windows Privilege Escalator

[Felix aka [xi-tauw] @PsiDragon]

@BHinfoSecurity Didn't you forget 6 somewhere in Rs?

[Felix aka [xi-tauw] @PsiDragon]

@hFireF0X UACME method 20. Probably wasn't fixed properly.

[Felix aka [xi-tauw] @PsiDragon]

UAC bypass:
Copy payload dll (IFileOperation) as C:\Windows\System32\wbem\wbemcomn.dll then run diskmgmt.msc
Essence: diskmgmt invokes start of vds service (NT AUTHORITY\SYSTEM), that loads the dll.
Also the dll could be used for persistence (via WmiPrvSE.exe), but I'm not sure.

[Felix aka [xi-tauw] @PsiDragon]

@404death @hFireF0X Must be in Administrators group. This is not privesc, only bypass UAC.

[Felix aka [xi-tauw] @PsiDragon]

@0xTback Yep. This is not privesc, only bypass UAC.

[Felix aka [xi-tauw] @PsiDragon]

GOG Galaxy. I almost forgot about this research by now (it was year ago), but the recent news about Cyberpunk 2077 reminded me that I haven’t publicly shared my research.
Rus - https://t.co/DCa049ev3R
Eng - https://t.co/MDzjzazYqT

[Felix aka [xi-tauw] @PsiDragon]

Little writeup for EOP for Dr.Web Security Space 12.
Rus - https://t.co/ukstn6b4xf
Eng - https://t.co/8XgwVWCibS

[Felix aka [xi-tauw] @PsiDragon]

Writeup for EOP for ABBYY FineReader (CVE-2019-20383).
Rus - https://t.co/TcsBIXxLgT
Eng - https://t.co/dP6Zs3hPQB

[Felix aka [xi-tauw] @PsiDragon]

@taviso I converted this into UAC bypass some time ago. https://t.co/M45lb8QQX0

[Felix aka [xi-tauw] @PsiDragon]

@decoder_it Already done =)

[Felix aka [xi-tauw] @PsiDragon]

@davidvalles007 Thanks. There were just winapi functions. From PoC:

[Felix aka [xi-tauw] @PsiDragon]

Writeup for EOP for Windows Origin client. (CVE-2019-19247 и CVE-2019-19248)
Rus - https://t.co/eQme2HO6mw
Eng - https://t.co/HkaRvV25Jy

[Felix aka [xi-tauw] @PsiDragon]

cc @enigma0x3, @tiraniddo
I bet you like CVE-2019-19247

[Felix aka [xi-tauw] @PsiDragon]

@0gtweet @424f424f WO

[Felix aka [xi-tauw] @PsiDragon]

@enigma0x3

[Felix aka [xi-tauw] @PsiDragon]

Writeup for third Steam vulnerability. #PublicDisclosure but not #0day this time, already patched.
Rus - https://t.co/DZssv8qbde
Eng - https://t.co/yrQc6yZb7l

[Felix aka [xi-tauw] @PsiDragon]

https://t.co/0mk1a70o0F
Third reported vulnerability has been fixed in main client. Hurray.

[Felix aka [xi-tauw] @PsiDragon]

@y3gou666 I created backup while researching.

[Felix aka [xi-tauw] @PsiDragon]

Unbanned on h1. So try do new report there.