Exploiting a Leaked Thread Handle
Summary: Project Zero's James Forshaw found a bug in Windows' Secondary Logon service, fixed in March 2016 as MS16-032, that let a normal process leak a full-access thread handle from the privileged service. The service's handle-duplication code checked that bit 29 was not set, so passing the pseudo-handle -2 caused the kernel to hand back a full-access handle to the service's own thread pool thread, which the researcher then used with NtImpersonateThread to obtain a system token and create a privileged process.
Key Takeaway: The exploit needed no memory corruption and no valid credentials - the LOGON_NETCREDENTIALS_ONLY flag let any caller reach the vulnerable path - and because the leaked handle pointed at a persistent thread pool thread, the service kept the handle alive for repeated attempts. A single leaked handle to a privileged thread was enough to turn an unprivileged process into SYSTEM.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026