Other nomination

Abusing Arbitrary File Deletes to Escalate Privilege and Other Great Tricks

Simon Zuckerbraun · Zero Day Initiative · 17 March 2022

Turns weak Windows filesystem primitives, an arbitrary file or folder delete, move or rename, into full SYSTEM privilege escalation by seizing the Windows Installer rollback folder and planting forged rollback scripts. Also shows an arbitrary folder create that permanently stops the machine booting.

Record

Researcher

Simon Zuckerbraun

Published by

Zero Day Initiative

Date

17 March 2022

Format

Advisory

In the archive

• Nominated for the 2024 Top 10 Web Hacking Techniques

Related sources

• Updated proof of concept (2024)

Tags

• privilege-escalation
• toctou
• race-condition
• dos
• attack-chain
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Simon Zuckerbraun, first published at the original source. Preserved copies are kept so the citation survives its host.