As Microsoft have no intensions of ever paying me for all my submitted vulnerabilities I am forced to do this.
Countdown starts today- then I will post them all public.
Ms is just trying to get time to patch them then never pay me.
I have for over 100.000$ in submissions.
14
I have not had a bounty paid for over 7 months I am in debt, my life is ruined- because I trusted that money was on the way.
I am getting sick by stress, but they just ignore me.
I have submitted hyper-v virtual file system escape.
bitlocker full hd encryption bypass
lock screen / login bypass
Total ntfs access control and file lock bypass for read from lowbox token sandbox
Uefi partition writeable from low box token sandbox
So many Escalation of privelegies I cannot keep track
Hyper-v file cache poisoning
Hyper-v host mem corruption
I have nothing left to loose, my adventure as trying to live from bug bounties have broken me.
I had the skill, but i placed the trust the wrong place.
Group policy service - Escalation of privelegie
Shell Create Object Task Server- Privilege escalation
DmEnrollment Service - Escalation of Privilege
XXXXXXXXXX - NTFS symlink mitigation bypass
Teredo driver - Escalation of Privelegie
Projected file system - Escalation of privelegie
Diagnostic tracking service - Escalation of privilege
Storage service - Escalation of privelegie
MSI Installer service - Escalation of privelegie
.net core - Escalation of privelegie
And all have been delivered with working proofs of concepts.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
@0gtweet@Hexacorn Lets not forget the hidden ones, those that begin with = the cmd: set " will show them
We find the setting for current directory on each drive amongs them
@0gtweet@Hexacorn Allright, first we see them then we wreck them.
Notice the = is used as split character- so what if we make a drive with that as its letter?
@0gtweet@Hexacorn yah, logic error- we are now eternally trapped on the weird frankenstein drive :D
My webdav based reflective loader/per process devicemap based dll injector POC is by now usable.
I would really like to have a OOP wrapper for NT- designing such is surprisingly difficult, but this approach shows potential especially considering simple
namespace httpd is simple local httpd using http.sys exposed with this interface:
httpd d{ L"LOCALHOST", L"" , L"8990", [&](request_response r) { try {
switch (r.requestVerb) {
case HttpVerbOPTIONS:
r.sendResponse(200, "");
webdav namespace implements webdav functionality using the httpd- interesting is handler for GET and PROPFIND.
Propfind is query like file search- c:\ is by default served
GET will respond with any file wanted, though special case for .dll in system32