Exploiting race conditions in Seclogon to bypass PPL protections dump LSASS.
The Windows Secondary Logon service (seclogon) represents a critical component of the Windows authentication architecture, enabling users to execute processes under alternative security contexts without requiring full credential disclosure. However, this legitimate functionality harbors a sophisticated race condition vulnerability that can be exploited to bypass Process Protection Light (PPL) mechanisms and gain unauthorized access to the Local Security Authority Subsystem Service (LSASS) memory.
This research presents a comprehensive analysis of a race condition attack against the Seclogon service that leverages Thread Environment Block (TEB) manipulation, Opportunistic Locks (OpLocks), and system-wide handle enumeration to achieve privilege escalation and credential extraction. The attack demonstrates how seemingly benign service features can be chained together to circumvent modern Windows security controls, including those designed specifically to protect high-value targets like LSASS.
How CPU virtualization extensions can be weaponized to build implants invisible to the host OS.
Hypervisors are pieces of software used to manage VMs (Virtual Machines) or Guest machines on a Host machine. The main difference between a hypervisor and an emulator is that the former allows the guest machine to execute most instructions on the hardware of the host machine by translating the guest’s instructions into the native machine code of the host - this provides superior performance compared to emulators, especially when it comes to tasks that are computationally intensive.
A deep dive into ETW providers and how EDRs consume telemetry under the hood.
Event Tracing for Windows (ETW) is a high-performance logging framework used for monitoring and debugging system and application activity. It is structured around providers, sessions, and consumers:
Abusing the W32Time service to load custom DLLs and persist through reboots.
When authenticating into a Domain Controller using the Kerberos protocol, especially during a CTF, we’ve all encountered the infamous Kerberos Clock Skew error, it looks something like this:
Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
This error is caused by Kerberos’ time-sensitive nature and occurs when there is a significant difference between the system clock of the client and the KDC (Key Distribution Center), in more technical terms: when the difference between the KDC system clock and the client’s system clock is outside of the clock skew tolerance range (the default value is 5 minutes).
Reversing how LSASS caches and decrypts DPAPI master keys in memory.
Before you start reading this post I’d like to point out that this is not a practical technique, no sane person would manually hunt for DPAPI blobs and decryption keys during an assessment - in fact, this is not a “technique” at all, the post is meant to showcase how LSASS handles DPAPI keys under the hood. With that out of the way, carry on ʕ •ᴥ•ʔ