Chaining Logical Bugs for Reliable Windows LPE

The talk argues that modern Windows mitigations have made memory corruption expensive, while logic flaws in privileged services still give dependable privilege escalation. The speaker treats low-severity bugs as reusable primitives, such as deleting a file, killing a process, or creating and deleting a registry key, and then combines them so that one fills the gap left by another.

The first chain links two service-level flaws. A Windows Search plugin reads an attacker-writable state file and deletes a path taken from it without checking for symlinks. A separate error reporting service, started on demand through an event trigger, terminates any process ID it receives without an access check. Restarting Search through a COM object lets the delete fire on demand. The second chain starts from a cloud files kernel driver that creates registry keys owned by the caller because of a missing security flag. A scheduled task that runs as SYSTEM then deletes keys through a followed link, and the result is a performance DLL registry entry that a system collector loads and executes.

Microsoft patched three of the four bugs, mostly by hiding the vulnerable code behind feature flags. The process-kill bug remained unpatched at the time of the talk. The practical takeaway is to look for partial control over a privileged resource, then search for a second primitive that makes it dangerous. Impersonation paths that create objects without an explicit owner also deserve close review.