https://www.zoemurmure.top/archives/2024/ Recent content in 2024 on Logic Security Hugo -- gohugo.io en Mon, 21 Oct 2024 18:15:39 +0800 https://www.zoemurmure.top/posts/cve_2024_43560/ Mon, 21 Oct 2024 18:15:39 +0800 https://www.zoemurmure.top/posts/cve_2024_43560/ 1. Background Based on the vulnerability name (Microsoft Windows Storage Port Driver), we can search and identify the corresponding file as storport.sys. This driver is used for communication between the computer and high-performance storage devices, defining how the computer communicates with these devices. 2. Patch Diffing System Version: Win11 22H2 Pro The diff shows that 6 functions were modified: After comparing the function code before and after the patch, the differences mainly lie in the calls to Feature_ class functions. https://www.zoemurmure.top/posts/windows_downdate/ Tue, 27 Aug 2024 15:55:41 +0800 https://www.zoemurmure.top/posts/windows_downdate/ Overview In this post, the author discovers vulnerabilities in Windows Update by examining its architecture and execution flow. Under Administrator privileges, an attacker can manipulate registry keys to control arbitrary system files, replacing them and bypassing system integrity checks. Due to the lack of downgrade file validation in the operating system, this capability can be leveraged to achieve further privilege escalation and security boundary bypasses. Principles Windows Update Architecture Approach 1: In the architecture shown above, privilege escalation from Administrator to Trusted Installer is possible.