Funny story, there was actually a security vulnerability in that Win+Number feature! Here's how it worked, there's a Windows security feature called UIPI (User

Funny story, there was actually a security vulnerability in that Win+Number feature! Here's how it worked, there's a Windows security feature called UIPI (User Interface Privilege Isolation) that prevents processes from sending messages to more privileged processes. That's critical, otherwise an unprivileged process can just send input to explorer and make it delete all your files or whatever. This was used to keep Internet Explorer sandboxed, so that if IE got compromised, it couldn't take over your computer. UIPI didn't prevent processes from triggering key combinations registered with RegisterHotKey() though, which is what explorer uses for things like Alt+Tab and so on. Turns out, there was a way to send input to cmd.exe windows, but it literally only worked on cmd.exe. That sounds bad, but an unprivileged process can't spawn a highly privileged cmd.exe, when you create a new process it just inherits your privilege level. That means you can't make it do anything you couldn't already do on your own. But.... you can spawn a low privileged cmd.exe, which gets added to the taskbar... then use the Win+Shift+Number shortcut registered with RegisterHotKey() to tell explorer to create a new window (Try it!). Explorer is already privileged, so the new window is spawned with privileges (technically, medium integrity) and then you can take it over! It's crazy, but that was a real bug. Here's a video of it working: https://twitter.com/Meatballs__/status/365233323406143489 https://twitter.com/Meatballs__/status/365233323406143489 And it's really in Metasploit: https://www.rapid7.com/db/modules/exploit/windows/local/ms13_005_hwnd_broadcast https://www.rapid7.com/db/modules/exploit/windows/local/ms13...