Windows Exploitation Techniques: Winning Race Conditions with Path Lookups

A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.

A Project Zero post in the Windows exploitation tricks series, showing how an arbitrary directory creation primitive can be escalated into arbitrary file read.

A race condition in OS X and iOS setuid binary loading leaves a short window to manipulate the memory of an euid 0 process, potentially gaining entitlements and loading unsigned kernel extensions.

A bug in the Windows Secondary Logon service, fixed as MS16-032, leaks a fully accessible thread handle from a privileged process, enabling privilege escalation without memory corruption.

A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.

Analyzing the attack surface of user-mode sandboxed applications helps find elevation of privilege bugs; automating the enumeration matters for initial analysis and detecting regressions.