1---2name: windows-boundaries3description: Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation4---56# Windows Security Boundaries78## When to Activate910- Planning a privilege-escalation path that crosses a Windows security boundary11 (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)12- Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged13 apps, AppContainer/LPAC brokers14- Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive15- Defeating PPL to dump LSASS or tamper with EDR self-defense16- Going from a `SeImpersonate` service account to SYSTEM via RPC/ALPC/named-pipe abuse17- UAC bypass (Medium → High) via auto-elevating COM or registry hijack1819## Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.2021## Technique Map2223| Technique | ATT&CK | CWE | Reference | Script |24|-----------|--------|-----|-----------|--------|25| win32k / dxgkrnl UAF → kernel R/W → token steal | T1068 | CWE-416 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py |26| Driver IOCTL abuse (METHOD_NEITHER arb-R/W) | T1068 | CWE-781 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py |27| BYOVD load + MSR/LSTAR or phys R/W → SYSTEM | T1068, T1543.003 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c |28| BYOVD EDR-kill (callback nulling) | T1562.001, T1014 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c |29| UAC bypass — ICMLuaUtil elevated COM moniker | T1548.002 | CWE-269 | references/integrity-uac-com.md | scripts/uac_com_elevate.cpp |30| UAC bypass — fodhelper HKCU registry hijack | T1548.002, T1112 | CWE-269 | references/integrity-uac-com.md | scripts/uac_com_elevate.cpp |31| AppContainer/LPAC broker abuse / cap over-grant | T1211 | CWE-668 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py |32| Chromium/Edge Mojo IPC sandbox escape | T1211 | CWE-501 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py |33| Named-object / symbolic-link squatting | T1211 | CWE-59 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py |34| PPL bypass — BYOVDLL (old signed DLL into PPL) | T1003.001, T1211 | CWE-426 | references/ppl-protected-process.md | scripts/ppl_byovdll.c |35| PPL bypass — live-dump / WER / Protection-clear | T1003.001, T1562.001 | CWE-269 | references/ppl-protected-process.md | scripts/byovd_kernel_rw.c |36| RPC server spoof / endpoint squat (PhantomRPC) | T1559, T1134.001 | CWE-287 | references/rpc-alpc-boundary.md | scripts/named_pipe_impersonate.c |37| Named-pipe client impersonation (Potato family) | T1134.002, T1134.001 | CWE-294 | references/rpc-alpc-boundary.md | scripts/named_pipe_impersonate.c |38| Host boundary posture enumeration | T1082 | CWE-693 | (all) | scripts/enum_boundaries.ps1 |3940## Quick Start4142```cmd43:: 0. Map the host's boundary posture -> pick the right primitive44powershell -ep bypass -File scripts/enum_boundaries.ps145:: reports: integrity, AppContainer, SeImpersonate/SeDebug, HVCI, driver blocklist,46:: LSASS RunAsPPL, drivers loaded from user-writable paths, named-pipe count.4748:: 1. From a sandbox (renderer/packaged app): rank escape vectors49python scripts/sandbox_escape_probe.py5051:: 2. Medium -> High: UAC bypass (no file dropped via COM moniker)52uac_com_elevate.exe com "C:\Windows\System32\cmd.exe /c whoami /groups > C:\poc.txt"5354:: 3. SeImpersonate present -> SYSTEM via PhantomRPC endpoint squat55whoami /priv | findstr SeImpersonate56named_pipe_impersonate.exe \\.\pipe\W32TIME "C:\Windows\System32\cmd.exe"57w32tm /resync :: triggers the SYSTEM client to connect5859:: 4. Need Ring 0: map a driver's IOCTLs, then BYOVD kernel R/W -> token steal60python scripts/ioctl_fuzzer.py --device RTCore64 --map61byovd_kernel_rw.exe C:\test\driver.sys token6263:: 5. Dump LSASS under PPL without a driver (BYOVDLL / CNG KSP)64ppl_byovdll.exe register C:\stage\vuln_ncryptprov.dll GhostKsp65ppl_byovdll.exe trigger GhostKsp66```6768## OPSEC & Detection (summary)6970| Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note |71|-----------|-----------------|--------------------------|------------|72| win32k/dxgkrnl exploit | Bugcheck EID 1001 ref win32k/dxgkrnl; process token flips to S-1-5-18 with no service genealogy | Sigma on bugchecks + token anomaly; ETW Microsoft-Windows-Win32k | Prefer data-only token copy over CFG/CET-fighting control-flow hijack; missed race = loud bugcheck |73| BYOVD | Sysmon EID 6 driver load from user-writable path; 7045/4697 kernel service; EDR telemetry goes silent | Sigma on unusual driver path + known-bad hashes (loldrivers.io); driver-load-time window | Use un-blocklisted/HVCI-compatible driver; restore LSTAR/callbacks; DeleteService + del .sys |74| UAC bypass (COM/fodhelper) | Sysmon EID 13 write to HKCU ms-settings\Shell\Open\command; dllhost /Processid:{3E5FC7F9..} spawning shell | Elastic/ManageEngine ICMLuaUtil + fodhelper rules | Rotate to a less-known AutoElevate CLSID; don't spawn cmd from dllhost; clean HKCU tree |75| Sandbox escape | Renderer/GPU process spawning cmd/powershell/rundll32; Mojo handle-transfer anomalies | Sigma on browser child-process; patch-posture alert (Edge<134.0.3124.93) | Stay in-process post-escape (IPC layer is an EDR blind spot); symlink squat is mostly dead post-2017 |76| PPL bypass | Old keyiso/ncryptprov version loaded in lsass (EID 7); EID 10 lsass read; Cryptography\Providers write; live-dump | Sigma on DLL version-mismatch + GrantedAccess to lsass | Driverless (BYOVDLL/WER/live-dump) avoids BYOVD noise; restore Protection byte; obfuscate dumps |77| RPC/ALPC impersonation | 4624 logon type 9 (Advapi); SYSTEM child of service-acct parent; RPC_S_SERVER_UNAVAILABLE (EID 1) | Elastic named-pipe impersonation rule; ETW RPC + high impersonation level | PhantomRPC endpoint squat blends w/ admin triggers (w32tm/gpupdate); RevertToSelf + close pipe |7879## Deep Dives8081- **references/kernel-user-boundary.md** — Ring 3→Ring 0 via win32k/dxgkrnl UAF82 (CVE-2025-24983, CVE-2025-62573, CVE-2025-55224, CVE-2025-62221, CVE-2026-26132), driver83 IOCTL surface, kernel R/W → EPROCESS token steal / Protection clear / PreviousMode, modern84 no-PTE-self-map constraint, KDP/HVCI considerations.85- **references/byovd-kernel-rw.md** — Bring-Your-Own-Vulnerable-Driver: load signed driver,86 MSR-LSTAR vs physical-memory primitives (CVE-2025-8061), EDRKillShifter / Qilin driver87 rotation, 2025-2026 driver+CVE catalog, blocklist/HVCI bypass, driver-load detection.88- **references/integrity-uac-com.md** — integrity model, appinfo/autoElevate internals,89 fodhelper (UACME 33) + ICMLuaUtil/CMSTPLUA (UACME 41), 2025 IEditionUpgradeManager bypass,90 finding new AutoElevate COM classes, T1548.002 ITW campaigns.91- **references/sandbox-appcontainer-escape.md** — AppContainer/LPAC model + capabilities,92 broker abuse (WinRT XmlDocument), Chromium/Edge Mojo escapes (CVE-2025-2783 ForumTroll,93 CVE-2025-4609 ipcz), symbolic-link/RtlIsSandboxToken mitigation, 3-bug renderer chain.94- **references/ppl-protected-process.md** — PS_PROTECTION/signer levels, BYOVDLL "Ghost in95 the PPL" (CVE-2023-28229/36906, BCryptRegisterProvider), NtSystemDebugControl live-dump96 (Win11 23H2), WER dump, kernel Protection-clear, PPLBlade, Credential Guard hard stop.97- **references/rpc-alpc-boundary.md** — named-pipe client impersonation primitive, ALPC98 SQoS/RequiredServerSid, PhantomRPC server-spoof/endpoint-squat (2026, unpatched), Potato99 family (PrintSpoofer/GodPotato/SigmaPotato), WER ALPC LPE, NtObjectManager enumeration.
hypnguyen1209