Windows Boundaries

name: windows-boundaries description: Windows security boundary attacks — kernel/user boundary, sandbox escape, AppContainer/LPAC bypass, COM/RPC boundary, integrity levels, PPL exploitation metadata: type: offensive phase: exploitation kill_chain: phase: [exploit, install] step: [4, 5] attck_tactics: [TA0002, TA0004] depends_on: [privesc-windows, exploit-development] feeds_into: [red-team-ops] inputs: [sandbox_config, kernel_info] outputs: [boundary_escape, elevated_access]

Windows Security Boundaries

When to Activate

• Planning privilege escalation paths through security boundaries
• Sandbox escape research (browser, Office, AppContainer)
• Understanding Windows security architecture for exploitation
• Kernel/user boundary crossing

Security Boundary Taxonomy

┌─────────────────────────────────────────────────────┐
│                    VTL1 (Secure World)               │
│  Credential Guard, HVCI, Secure Kernel              │
├─────────────────────────────────────────────────────┤
│                    VTL0 (Normal World)               │
│  ┌───────────────────────────────────────────────┐  │
│  │              Kernel Mode (Ring 0)              │  │
│  │  ntoskrnl, win32k, drivers                    │  │
│  ├───────────────────────────────────────────────┤  │
│  │              User Mode (Ring 3)               │  │
│  │  ┌─────────────────────────────────────────┐  │  │
│  │  │  High Integrity (Admin)                 │  │  │
│  │  │  ┌───────────────────────────────────┐  │  │  │
│  │  │  │  Medium Integrity (Standard User) │  │  │  │
│  │  │  │  ┌─────────────────────────────┐  │  │  │  │
│  │  │  │  │  Low Integrity              │  │  │  │  │
│  │  │  │  │  ┌───────────────────────┐  │  │  │  │  │
│  │  │  │  │  │  AppContainer/LPAC   │  │  │  │  │  │
│  │  │  │  │  │  (Untrusted)         │  │  │  │  │  │
│  │  │  │  │  └───────────────────────┘  │  │  │  │  │
│  │  │  │  └─────────────────────────────┘  │  │  │  │
│  │  │  └───────────────────────────────────┘  │  │  │
│  │  └─────────────────────────────────────────┘  │  │
│  └───────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────┘

Kernel/User Boundary

Attack Surface

• System calls (ntoskrnl, win32k)
• IOCTLs to kernel drivers
• Shared memory sections
• GDI/DirectX objects

Exploitation Vectors

// win32k.sys — historically most exploited Windows kernel component
// Attack: trigger vulnerability via GDI/USER syscalls from user mode
// Common bug classes: UAF in window objects, integer overflow in font parsing

// Driver IOCTLs — third-party drivers often vulnerable
// Attack: send crafted IOCTL to driver device object
HANDLE hDevice = CreateFileA("\\\\.\\VulnDriver", GENERIC_READ|GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
DeviceIoControl(hDevice, IOCTL_CODE, inputBuf, inputSize, outputBuf, outputSize, &bytesReturned, NULL);

// BYOVD (Bring Your Own Vulnerable Driver)
// Load known-vulnerable signed driver, exploit it for kernel R/W
// Popular targets: RTCore64.sys, dbutil_2_3.sys, ene.sys, gdrv.sys

Kernel Exploitation Primitives

1. Arbitrary Read → leak kernel addresses (bypass KASLR)
2. Arbitrary Write → overwrite token privileges, disable PPL
3. Common targets:
   - EPROCESS.Token → steal SYSTEM token
   - EPROCESS.Protection → disable PPL
   - PreviousMode → set to KernelMode for unrestricted syscalls

Integrity Level Boundaries

Levels

Crossing Boundaries

# Check integrity level
whoami /groups | findstr "Mandatory"

# Medium → High: UAC bypass (see privesc-windows skill)
# Low → Medium: exploit vulnerability in medium-integrity process
# AppContainer → Low: sandbox escape

AppContainer / LPAC Sandbox

What's Restricted

• No access to user's files (except broker-mediated)
• No network access without explicit capability
• No registry access outside own hive
• No inter-process communication without broker
• LPAC (Less Privileged AppContainer): even more restricted — no access to named objects

Escape Vectors

1. Broker vulnerabilities — the broker process mediates access
   - File picker broker (allows file access)
   - Print broker
   - Clipboard broker

2. Kernel vulnerabilities — AppContainer is userland enforcement
   - win32k syscalls still accessible (reduced but not eliminated)
   - Kernel bug = full escape

3. COM object abuse — some COM servers run at higher integrity
   - Find COM objects accessible from AppContainer
   - Exploit logic bugs in COM server

4. Named pipe/ALPC — if broker exposes pipe without proper ACL

5. Capability abuse — overly permissive capabilities granted
   - internetClient, privateNetworkClientServer
   - documentsLibrary, picturesLibrary

Browser Sandbox Escape (Chromium/Edge)

Renderer (AppContainer/Untrusted) → Browser Process (Medium)
Attack surface:
- Mojo IPC interface bugs
- Shared memory corruption
- GPU process as intermediate target
- PDF/extension process boundaries

Typical chain:
1. Renderer RCE (V8 bug, type confusion)
2. Sandbox escape (Mojo IPC bug, win32k bug)
3. Privilege escalation (kernel bug or UAC bypass)

COM/RPC Boundaries

COM Elevation

// COM objects that auto-elevate (no UAC prompt):
// CMSTPLUA: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
// ICMLuaUtil interface — can launch elevated processes

// Exploit: instantiate elevated COM object, call methods
CoInitialize(NULL);
IID iid_ICMLuaUtil = {0x6EDD6D74, 0xC007, 0x4E75, {0xB7, 0x6A, 0xE5, 0x74, 0x09, 0x95, 0xE2, 0x4C}};
CLSID clsid_CMSTPLUA = {0x3E5FC7F9, 0x9A51, 0x4367, {0x90, 0x63, 0xA1, 0x20, 0x24, 0x4F, 0xBE, 0xC7}};
// CoCreateInstance with CLSCTX_LOCAL_SERVER → runs elevated

RPC Attack Surface

# Enumerate RPC interfaces
rpcdump.py target_ip
# Or: RpcView tool for local enumeration

# Common targets:
# - Print Spooler RPC (PrintNightmare)
# - Task Scheduler RPC
# - EFSRPC (PetitPotam)
# - MS-DRSR (DCSync)

Hyper-V / VBS Boundary

VTL0 → VTL1 (Secure World)

- VTL1 runs Secure Kernel, Credential Guard, HVCI
- VTL0 cannot read/write VTL1 memory
- Escape requires: Hyper-V vulnerability (extremely rare, high bounty)
- Attack surface: hypercalls, synthetic interrupts, VMBUS

VM Escape (Guest → Host)

- Hyper-V attack surface: VMBus, synthetic devices, RemoteFX
- VMware: SVGA, HGFS, backdoor interface
- VirtualBox: 3D acceleration, shared folders, guest additions
- QEMU/KVM: virtio devices, SPICE, USB passthrough

Practical Boundary Crossing Chains

Browser → SYSTEM

1. V8 type confusion → renderer RCE (Untrusted integrity)
2. Mojo IPC bug → sandbox escape to browser process (Medium)
3. BYOVD or kernel bug → SYSTEM

Office Macro → Domain Admin

1. VBA macro execution (Medium integrity)
2. AMSI bypass + download Stage 1
3. Credential harvesting or Kerberoast
4. Lateral movement → Domain Controller
5. DCSync → Domain Admin

Phishing → Kernel

1. HTML smuggling → ISO → DLL sideload (Medium)
2. UAC bypass → High integrity
3. Load vulnerable driver (BYOVD)
4. Kernel R/W primitive → disable PPL, steal SYSTEM token

Advanced: Browser Sandbox Escape

Chromium Sandbox Architecture

// Chromium uses multi-process architecture:
// - Browser process: full privileges, manages tabs
// - Renderer process: sandboxed (AppContainer on Windows)
// - GPU process: limited sandbox
// - Network process: limited sandbox
//
// Sandbox restrictions (renderer):
// - No filesystem access (except via IPC to browser)
// - No network access (except via IPC)
// - No process creation
// - Limited Windows API access
// - AppContainer integrity level (below Low)

// Escape path: Renderer RCE → IPC bug → Browser process
// IPC mechanism: Mojo (Chromium's IPC framework)
// Attack surface: every Mojo interface exposed to renderer

Mojo IPC Exploitation

// Mojo interfaces define the renderer→browser attack surface
// Each interface = potential sandbox escape if mishandled

// Common vulnerability patterns:
// 1. Type confusion in Mojo message deserialization
// 2. UAF when interface pointer outlives backing object
// 3. Race condition between validation and use
// 4. Missing origin checks (renderer claims wrong origin)

// Exploitation:
// 1. Achieve renderer RCE (V8 type confusion, JIT bug)
// 2. Enumerate available Mojo interfaces
// 3. Fuzz or audit interface implementations in browser process
// 4. Trigger bug → code execution in browser process (Medium integrity)
// 5. From browser process: full system access or further escalation

// Historical examples:
// CVE-2019-5786: FileReader UAF → renderer RCE → Mojo escape
// CVE-2021-21224: V8 type confusion → Mojo IPC → sandbox escape
// CVE-2022-0609: Animation UAF → full chain

Windows Sandbox Escape Techniques

// AppContainer escape vectors:
// 1. Kernel vulnerability (win32k, ntoskrnl)
//    - AppContainer can still make syscalls
//    - win32k attack surface reduced but not eliminated
//    - Kernel bug → SYSTEM (bypasses all userland sandboxes)

// 2. Named object abuse
//    - Some named objects accessible from AppContainer
//    - If higher-privilege process opens object with weak DACL
//    - AppContainer can interact with it

// 3. ALPC/RPC to privileged services
//    - Some RPC endpoints accessible from AppContainer
//    - Vulnerability in RPC handler → escape
//    - Example: Print Spooler accessible from some sandboxes

// 4. Token manipulation
//    - If sandbox has SeImpersonatePrivilege (rare)
//    - Potato-style attacks work from sandbox
//    - Usually sandboxes strip this privilege

// 5. Shared memory / mapped sections
//    - If shared section has weak permissions
//    - Corrupt data used by higher-privilege process
//    - Example: shared font cache corruption → win32k exploit

Advanced: PPL (Protected Process Light) Exploitation

PPL Architecture

// PPL levels (highest to lowest):
// - PPL-Windows: OS critical processes
// - PPL-WinTcb: Windows Trusted Computer Base
// - PPL-Antimalware: AV/EDR processes (MsMpEng.exe, CrowdStrike)
// - PPL-Lsa: LSASS (when RunAsPPL enabled)
// - PP-Authenticode: signed processes
//
// PPL prevents:
// - OpenProcess with PROCESS_VM_READ/WRITE
// - Debugging (DebugActiveProcess)
// - Thread injection (CreateRemoteThread)
// - Memory reading (ReadProcessMemory)
// - DLL injection
//
// Even SYSTEM cannot open PPL process with full access

PPL Bypass Techniques

// 1. BYOVD → kernel R/W → modify EPROCESS.Protection field
//    Set Protection.Level = 0 → process is no longer protected
//    Then: normal OpenProcess/ReadProcessMemory works
BYTE protection_offset = 0x87A;  // Offset varies by Windows version
WriteKernelMemory(eprocess + protection_offset, 0, 1);  // Clear protection

// 2. PPLdump (abuse PPL-signed DLL)
//    Load DLL signed with PPL-compatible certificate
//    DLL runs inside PPL process → can read its memory
//    Dump LSASS from within PPL context

// 3. PPLKiller (vulnerable driver)
//    Use signed driver with R/W primitive
//    Modify EPROCESS.SignatureLevel and Protection
//    Process becomes unprotected → dump normally

// 4. Mimikatz driver (mimidrv.sys)
//    Mimikatz's own signed driver
//    Removes PPL protection from LSASS
//    Then: sekurlsa::logonpasswords works

// 5. Userland exploit in PPL process
//    If PPL process has vulnerability (e.g., DLL hijack)
//    Exploit it → code execution within PPL context
//    From inside: full access to PPL memory

Advanced: COM/RPC Boundary Attacks

COM Activation Attacks

// COM objects can be activated cross-process and cross-integrity
// If COM server runs at higher integrity → potential escalation

// Attack: find COM object that:
// 1. Runs as SYSTEM or high integrity
// 2. Exposes dangerous methods (file write, command exec)
// 3. Accessible from medium/low integrity

// Discovery:
// OleViewDotNet — enumerate COM objects, check permissions
// Look for: LaunchPermission allows Everyone/Users
// Check: methods that take file paths or command strings

// Historical: CMSTPLUA, ICMLuaUtil (UAC bypass via COM)
// These COM objects auto-elevate and expose ShellExec methods

RPC Interface Exploitation

// Windows RPC: thousands of interfaces, many accessible remotely
// Each interface = potential attack surface

// Enumeration:
// rpcdump.py — list RPC interfaces on target
// RpcView — GUI tool for local RPC interface analysis
// NtObjectManager — PowerShell module for RPC analysis

// Attack methodology:
// 1. Enumerate interfaces (rpcdump, ifids)
// 2. Identify interesting interfaces (file ops, process creation)
// 3. Check access permissions (who can call?)
// 4. Fuzz interface methods
// 5. Exploit: type confusion, buffer overflow, logic bugs

// PetitPotam (MS-EFSRPC): RPC interface that coerces NTLM auth
// PrinterBug (MS-RPRN): RPC interface that coerces NTLM auth
// Both: accessible remotely with domain user credentials

Advanced: Integrity Level Escalation

Medium → High (UAC Bypass Catalog)

# Auto-elevating binaries (Microsoft-signed, manifest has autoElevate=true):
# fodhelper.exe, computerdefaults.exe, sdclt.exe, slui.exe
# eventvwr.exe, cmstp.exe, wsreset.exe, changepk.exe

# Technique: registry key hijacking
# These binaries read HKCU registry before executing
# Attacker writes command to HKCU → binary auto-elevates → executes attacker command

# Example: fodhelper.exe
# Reads: HKCU\Software\Classes\ms-settings\Shell\Open\command
# Write payload there → run fodhelper → payload runs elevated

# Environment variable abuse:
# Some auto-elevate binaries use %SYSTEMROOT% or %WINDIR%
# If attacker can control env var → DLL hijack in fake system directory

Low → Medium

// Low integrity → Medium integrity is a security boundary
// Escape vectors:
// 1. Exploit vulnerability in medium-integrity process
// 2. Abuse shared resources (clipboard, drag-drop)
// 3. Exploit broker process (if application uses broker pattern)
// 4. Kernel vulnerability (bypasses all integrity levels)
// 5. Time-of-check-time-of-use on shared files