Share on

Hunting & Exploiting bugs in Windows File Share and Management

REGISTER

Talk Overview:

This talk primarily discusses the exploration of hunting and exploiting vulnerabilities in Windows File Sharing and Management facilities. We will show an overview of the relevant software and functionalities, emphasizing the unique features and potential security risks associated with DFS(Distributed File System), Azure File Sync, Windows Server Backup, and FSRM(File Server Resource Manager) and discuss a total of 2 RCE(Remote Code Execution) and 4 EOP(Elevation of Privilege) vulnerabilities in these services.

Furthermore, the talk delves into the potential vulnerabilities that may exist in file sharing and management software. It thoroughly examines the attack surfaces, including leveraging high-privileged processes for privilege escalation, local attack scenarios, and potential vulnerabilities in the remote attack surface.

Finally, through demonstration examples of an EOP and an RCE, we will demonstrate an innovative combination of traditional symbolic linking, path traversal, and race condition exploitation techniques to gain a hard-to-fix remote code execution vulnerabilities on Windows file share facilities.

Yingli Sun is a graduate student from the Institute of Information Engineering. He is interested in Windows Escalation of Privilege and is currently studying Bug Hunting and large-scale project analysis. He is also a member of the CTF team NeSE. Fangming Gu is a doctoral candidate at the Institute of Information Engineering, Chinese Academy of Sciences. His focus is on Windows security research and complex software reverse engineering. He also devotes time to build automated bug-finding tools. QingHe Xie is a master student at the Institute of Information Engineering, Chinese Academy of Sciences. He focuses on fuzzing and reverse engineering, and is very interested in Windows and Virtualization Security. He is also a pwner of the CTF team NeSE.
REGISTER
Fangming Gu, Yingli Sun & Qinghe Xie
Yingli Sun is a graduate student from the Institute of Information Engineering. He is interested in Windows Escalation of Privilege and is currently studying Bug Hunting and large-scale project analysis. He is also a member of the CTF team NeSE. Fangming Gu is a doctoral candidate at the Institute of Information Engineering, Chinese Academy of Sciences. His focus is on Windows security research and complex software reverse engineering. He also devotes time to build automated bug-finding tools. QingHe Xie is a master student at the Institute of Information Engineering, Chinese Academy of Sciences. He focuses on fuzzing and reverse engineering, and is very interested in Windows and Virtualization Security. He is also a pwner of the CTF team NeSE.