Battle of Windows Service - A Silver Bullet to Discover File Privilege Escalation Bugs Automatically

Explore a groundbreaking technique for automatically discovering file privilege escalation bugs in Windows services in this 21-minute Black Hat conference talk. Delve into the methodology developed by a web security researcher with minimal initial knowledge of Windows internals. Learn about the analysis of Advanced Local Procedure Call (ALPC), the identification of new attack surfaces, and the implementation of hot patches to transform process monitoring into a command-line tool for detecting sensitive operations. Gain insights into the inner workings of this innovative system that combines various elements to automate the discovery of file privilege escalation vulnerabilities. Follow the presenter's journey from historical bug analysis to the development of a powerful tool for enhancing Windows security.