👻 Ghost in the PPL Part 2: From BYOVDLL to Arbitrary Code Execution in LSASS
In this second installment, the author deepens the exploration of techniques for bypassing LSASS protection, focusing on arbitrary code execution by refining the PoC, exploiting vulnerabilities like CVE-2023-28229, and bypassing Control Flow Guard (CFG) through RPC-based process handle duplication.
🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-2/
#lsa #lsass #ppl #dll #maldev
Post #1086
6.14K
APT 👻 Ghost in the PPL: BYOVDLL This blog post explores bypassing LSA Protection in Userland through the "Bring Your Own Vulnerable DLL" (BYOVDLL) technique. It also delves into the successful exploitation of vulnerabilities in the CNG Key Isolation service and…itm4n’s blog Ghost in the PPL Part 2: From BYOVDLL to Arbitrary Code Execution in LSASS In the previous part, I showed how a technique called “Bring Your Own Vulnerable DLL” (BYOVDLL) could be used to reintroduce known vulnerabilities in LSASS, even when it’s protected. In this second part, I’m going to discuss the strategies I considered and…
- 🔥 8