Tokenvator Release 3

NetSPI releases Tokenvator 2, a .NET token manipulation tool adding token display, privilege disabling and removal, named pipe tokens, and minifilter manipulation for Windows privilege escalation.

Alexander Leary introduces Tokenvator, a .NET tool spun out of WheresMyImplant for stealing and manipulating Windows tokens, with GetSystem and GetTrustedInstaller commands to elevate privileges.

A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.

A Project Zero post in the Windows exploitation tricks series, showing how an arbitrary directory creation primitive can be escalated into arbitrary file read.

A bug in the Windows Secondary Logon service, fixed as MS16-032, leaks a fully accessible thread handle from a privileged process, enabling privilege escalation without memory corruption.

A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.