Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege
Summary: Project Zero's James Forshaw detailed how Issue 1550 lets a normal user create an arbitrary object manager directory as SYSTEM, because the AppInfo service calls CreateAppContainerToken without impersonating the user, and the user can plant a symbolic link in their AppContainerNamedObjects directory to redirect the creation. He then chained it with CSRSS's BaseSrvDefineDosDevice, which recreates a symbolic link without impersonation when the opened object's name begins with \GLOBAL??\, to turn the arbitrary directory creation into local elevation of privilege.
Bottom line: The exploit depends on a privileged service trusting a path prefix check and on winning a race to hold a handle to a directory before it is deleted, which Forshaw notes is reliable on any multi-processor system. A single writable child directory under the global DOS device namespace is enough to make CSRSS recreate a link as SYSTEM.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026