Post

James Forshaw
@tiraniddo.dev

I'm going to be at Blackhat Europe 2024 this Wednesday and Thursday. I should also be at BSides London. Just in case anyone wants to find me to sign a book or complain about something Windows related :D

2 reposts8 likes

ptr0x1
@ptr0x1.bsky.social

I have something random to complain about remotely is that okay too? I've been playing with your old symlink tools (still fun!) and noticed the Win11 24H2 now seems to avoid opening handles to folders with CreateFile even with ye old INDEX_ALLOCATION. I lost weeks not understanding this lol.

James Forshaw
@tiraniddo.dev

Well that sucks, I'll have to check that behavior when I get a chance. But it wouldn't surprise me if they've changed it, 24H2 seems to have a few new mitigations against explotation.

ptr0x1
@ptr0x1.bsky.social

If you do follow up and find anything interesting around this I would be super curious! I usually used this to demonstrate file delete into EOP impact but will need a new vector there. In any case thanks for all the great resources you share.