Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege
Summary: Project Zero's James Forshaw detailed a technique for exploiting arbitrary file writes on Windows 10 to gain local elevation of privilege, using the Microsoft Diagnostics Hub Standard Collector Service (DiagHub) to load an arbitrary DLL from SYSTEM32. He illustrated it with issue 1428, a vulnerability Project Zero reported to Microsoft and which was recently fixed, and noted that the Spring Creators Update (RS4) remediated the mount-point-to-file abuse from his earlier post.
What you should know: A privileged service that will load any DLL from SYSTEM32 on request removes the usual hurdles of DLL hijacking, and this same DiagHub feature was already abused twice before - once by Lokihardt for a sandbox escape and once by Forshaw for user-to-system escalation.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026