The Next Generation of Windows Exploitation: Attacking the Common Log File System

Описание

The Common Log File System (CLFS) is a new logging mechanism introduced by Windows Vista, which is responsible for providing a high-performance, universal log file subsystem. In this session, we will share our research process on CLFS, including how to analyze the attack surface, how to design targeted fuzz to find some vulnerabilities, and we will also introduce a vulnerability prepared for Tianfu Cup and how to exploit it. In the exploit stage, we will summarize the historically common exploit methods and their limitations, and disclose a new universal exploit method.

By: Shijie Xu, Jianyang Song & Linshuang Li

Full Abstract & Presentation Materials: https://www.blackhat.com/asia-22/briefings/schedule/index.html#the-next-generation-of-windows-exploitation-attacking-the-common-log-file-system-25679