The Hidden Risk in Undocumented API Behavior
summary
Undocumented Windows registry symbolic links cause deletion APIs to remove the target not the link, letting a non‑admin create a link under writable keys and trick privileged services to delete protected keys. Using AccessChk and ProcMon, exploits include enabling AlwaysInstallElevated via HKCU\Software\Policies to escalate MSI installs to SYSTEM, deleting AV/EDR service keys to disable protection, and forcing Google Omaha uninstall flow to delete FilterManager (blue screen) or BFE (firewall off). Tested 18 vendors, 16 vulnerable; vendors have since patched using the undocumented native delete API.
AI-written summary · about
chapters (19)
- 0:00Undocumented API risks
- 1:31Windows symbolic links
- 4:02Registry symbolic links risks
- 6:33Microsoft’s incomplete API documentation
- 9:02Registry key delete behavior
- 11:57Antivirus EDR vulnerabilities
- 14:06Finding registry keys
- 16:58Always Install Elevated exploit
- 22:05Privilege escalation demo
- 26:04Disabling security via links
- 29:20System damage potential
- 30:45Industry-wide vulnerability root causes
- 31:06Beyond antivirus and EDR
- 31:48Omaha updater registry risks
- 38:19Forcing app reinstallation
- 41:39Blue screen attack demo
- 44:11Disabling Windows Firewall via Chrome
- 46:44Practical tips for software vendors
- 48:09Key takeaways
related talks
36mThe Hidden Risk in Undocumented API Behavior
48m"Sneaking Past Device Guard"
51mSneaking Past Device Guard
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
29mPrivilege Escalation and Whitelisting Bypass with Proxy DLLs