DEF CON 31 - #NoFilter Abusing Windows Filtering Platform for privilege escalation - Ron Ben Yizhak

Privilege escalation is a common attack vector in the Windows OS.

Today, there are multiple offensive tools in the wild that can execute code as “NT AUTHORITY\SYSTEM” (Meterpreter, CobaltStrike, Potato tools), and they all usually do so by duplicating tokens and manipulating services in some way or another. This talk will show an evasive and undetected privilege escalation technique that abuses the Windows Filtering Platform (WFP). This platform processes network traffic and allow configuring filters that permit or block communication. …

abusing attack attack vector authority ben cobaltstrike code con def def con def con 31 escalation meterpreter nofilter offensive platform privilege privilege escalation ron services system today tokens tools windows windows filtering platform windows os