PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 7 - Secure Desktop keylogger

0xpat.github.io | blog | #privilege-escalation | #windows | #red-team | #malware-development | #keylogger | #secure-desktop | #winlogon
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 7 of the malware dev series builds a Secure Desktop keylogger: after escalating to SYSTEM, a low-level keyboard hook on the WINLOGON desktop captures credentials typed into UAC and logon prompts.
Published
Collected

Related coverage

blog · projectzero.google
Raising the Dead
A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.
blog · projectzero.google
Windows Sandbox Attack Surface Analysis
Analyzing the attack surface of user-mode sandboxed applications helps find elevation of privilege bugs; automating the enumeration matters for initial analysis and detecting regressions.
blog · projectzero.google
Windows Drivers are True’ly Tricky
A bug in the TrueCrypt Windows driver, despite prior security audits, lets a normal user or low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or kernel.
blog · projectzero.google
Windows 10^H^H Symbolic Link Mitigations
Years of Windows elevation of privilege research distilled into an overview of symbolic link mitigations, a technique long used to redirect privileged code and escape restricted execution contexts.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Back