The Definitive Guide on Win32 to NT Path Conversion

A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.

A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.

And we’re back again for another blog in my series on Windows Exploitation tricks. This time I’ll detail how I was able to exploit Issue 1550 which results in an arbitrary object directory being created by using a useful behavior of the CSRSS privileged process. Once again by detailing how I’d exploit a particular vulnerability I hope that readers get a better understanding of the complexity of the Windows operating system as well as giving Microsoft information on non-memory corruption exploitation techniques so that they can mitigate them in some way.

A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.

A Project Zero write-up showing how a local network attacker can abuse Windows 10 WPAD/PAC proxy files, executed as JavaScript by jscript.dll, to achieve remote code execution.

A Project Zero post on using binary patch diffing to uncover Windows kernel memory disclosure bugs, including methodology, tooling, and notable findings from this approach.