← Feed

Posts

• View post

  Found another hilariously trivial Windows PPL, hard to believe I didn't see this one earlier. Doesn't work in full PP due to the nature of it, but TBH PPL-WinTCB is really all you need :)

• View post

  Seems that the trick I used in https://projectzero.google/2025/01/windows-bug-class-accessing-trapped-com.html by calling ITypeInfo::CreateInstance cross process has been blocked. Sort of. They've "fixed" it in a bizarre way, there's now a new AppCompat key, which doesn't exist by default. It's HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ITypeInfoCreateInstanceSettings and in that you need a AllowedOutOfProcIIDList REG_MULTI_SZ value which provides the allow l...

• View post

  Currently implementing an airgapped network by adding two network cards to a macbook air and turning on IP forwarding.

• View post

  @GossiTheDog is Mythos going to be the new go to excuse, after no one believed that they were hit by an "Advanced Attacker"?

• View post

  Lolz https://www.synacktiv.com/sites/default/files/inline-images/scroll_of_truth.webp https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1.html https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html

• View post

  I don't know flash card, zero rugby balls? The things we teach children today, sheesh.

• View post

  Project Zero have finally got around to updating the blog to something less blogger-esc, check it out at https://projectzero.google. To coincide with this momentous occasion I dug out the draft of my blog post about Windows Object Manager performance which became the basis of my article in PoC||GTFO #13 and updated it to see if it still worked in Windows 11. You can read it at https://projectzero.google/2025/12/windows-exploitation-techniques.html

• View post

  My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D

• View post

  @lcamtuf $700 a week I assume? :)

• View post

  @wdormann oh I see, it passes back a handle. I assumed Defender did something to the file, then the unprivileged process opened the file. And yeah if it passes back a read-only handle then the code can parse out the SAM's contents as everything else needed to decrypt the hashes is accessible without any privileges (bizarre IMO). No doubt it'd be relatively easy to narrow this down to something simpler as a PoC, perhaps that didn't help their case with MSRC who as you point out have...

• View post

  Fucks sake, Defender is now signaturing on builds of my v2 version of NtObjectManager, god knows why. I fucking hate MS and Defender especially.

• View post

  I've put up the slides from my Zer0Con 2026 presentation on Administrator Protection. https://github.com/tyranid/infosec-presentations/blob/master/Zer0Con/2026/Protecting%20your%20Administrator.pdf

• View post

  RE: https://hachyderm.io/@pheonix/116050795790003647 FFS

• View post

  Released the second part of my blog post series on Admin Protection. This time it's about how most of the bugs I found came about due to abusing UI Access which was overlooked as UAC bypasses because, well, they were UAC bypasses. https://projectzero.google/2026/02/windows-administrator-protection.html

• View post

  @0x00string they're trying, in the UK I can no longer use "social media" parts of xbox live without verifying my ID. As I have no friends that really doesn't bother me. But I do wonder how long until they do something I do care about. I can apparently play mature content fine, it's only the online aspects, for now. What's crazy is the MS account is a US one, paid for by a US CC and yet because the xbox is sitting in the UK they apply the stupid...

• View post

  @GossiTheDog I so dislike going through US immigration. Even with a green card I felt I was one CBP officer's or computer's bad day away from being locked up. I finally decided to give up the greencard once I'd been out for 12 months to give me one less thing to worry about if I have to unfortunately travel there for work. Though no doubt I'll now get questions on why I'd relinquish such a valuable opportunity to become a citizen of the greatest country in...

• View post

  @rupert @GossiTheDog yeah I'm sure it'll be fine, it was mostly in jest, but you never know. That said, I'm going to do my best to never need to travel there again, which is somewhat hard in the tech industry.

• View post

  The new macbook neo looks somewhat cute, but, it doesn't come with a PSU? Really? Is this going to be the new normal going forward for laptops? This seems to at least be the case in the UK, checking the US website it comes with a 20W USB-C PSU.

• View post

  The new Google office in London is looking nice. https://blog.google/company-news/inside-google/around-the-globe/google-europe/united-kingdom/platform-37-the-ai-exchange/ I especially like how it's super energy efficient and uses low carbon materials while touting the world destroying tech that is AI. A masterclass of green washing.

• View post

  Of course I’m deeply angry that apple chose to prostate themselves to the ineffectual ofcom who should be spending their time enforcing real laws like against GBNews. But I do wonder what happens now with devices if you log off from your unverified apple account. Does it revert to “normal” operation ? Or with 26.4 will it come up by default in kid mode? Can you use an iPhone anymore without ever signing in?

• View post

  My final blog related to admin protection is up. https://projectzero.google/2026/02/gphfh-deep-dive.html I go into a bit of history of the interesting GetProcessHandleFromHwnd API, how it ended up allow you to bypass protected process restrictions and how it's now "fixed".

• View post

  Testament to a Man's Hubris: Unknown Contractor 2024.