Windows CreateObjectTask TileUserBroker Privlege Escalation
Posted by deepcore on September 20, 2015 – 6:06 am
The MicrosoftWindowsShellCreateObjectTask initializes a shell32 based ICreateObject COM server as local system. This is marked as being accessible from a normal user account so once created we can attach to it. The server only has one method, CreateObject which checks the CLSID against a list of known safe classes before allowing it to be instantiated. One of these classes is allows a user to set their account picture for the logon screen.
Post a reply
You must be logged in to post a comment.