3 ms·
I don’t think “only invoke MSI signed executables” inspires confidence either. There’s ought to be an MSI signed executable that launches arbitrary executables
by drdexebtjl 4mo ago
I don’t think “only invoke MSI signed executables” inspires confidence either. There’s ought to be an MSI signed executable that launches arbitrary executables by design and defeats the mitigation.
The author got around a similar mitigation in their exploit for ASUS DriverHub (linked in the original article).
- everyflavourvms 4mo agoOh right, yes, either that, or one of them is bound to have a DLL hijack issue that can be taken advantage of.
- drdexebtjl 4mo agoOr just a TOCTOU race :)