Recent Windows zero day dubbed Polarbear discovered and reported by SandboxEscaper

1. Recent Windows 0day
By Japneet Singh

2. Agenda
• Few basics
• Vulnerability
• Demo

3. Few basics
• Task scheduler
• Impersonation
• Hard links
• DACL

4. Vulnerability
• During importing an old .job file (from XP)
• First impersonates, then sets security on .job file after reverting
impersonation
• Sets DACL on .job allowing access to the user

5. Exploit
• Create hard link pointing the job file to a System file
• Trigger import of job file again leading to DACL on hard link target
instead

6. Demo
• Polarbear demo

7. References
• https://github.com/SandboxEscaper/polarbearrepo