When the handle is opened with delete permissions, there is nothing done to prevent it from following any links a standard user could create, allowing for potential privilege escalation to NT AUTHORITY\SYSTEM.
Using file attribute changes as an indicator, an exploit can be timed to follow a link and delete a target directory, leveraging ESET's handling process to escalate privileges.
Creating a symbolic link at the right time, leveraging file attribute changes, is crucial to the success of the exploit, offering insight into when the target directory will be deleted by ekrn.exe.
Standard Windows users may lack the SeCreateSymbolicLinkPrivilege needed to create symbolic links directly, highlighting a potential limitation for the exploit.
[
Collection
]
[
|
...
]