Tag
#privilege-escalation
RogueProvision: Windows Privilege Escalation in the Provisioning Engine — the SYSTEM Task That Applies Unsigned Packages
A SYSTEM service silently applies unsigned configuration packages from a folder — no signature, no consent, no interaction. Microsoft's docs promise otherwise. The honest catch: on a normal PC it's admin→SYSTEM, and a symbol's name fooled the analysis into believing otherwise.
Inside NOFILTER-NFEXEC: A Deep Dive into WFP Implementation and BOF OPSEC Engineering
A detailed walkthrough of implementing the DEF CON 31 NoFilter WFP technique as an OPSEC-hardened Havoc C2 BOF, including indirect syscalls, return address spoofing, patchless AMSI/ETW bypass, and lessons learned from Havoc BOF development.