Skip to content

Commit 67c7b5c

Browse files
carlospolopcarlospolop
authored
Merge pull request #2013 from HackTricks-wiki/update_RIP_RegPwn_20260317_015806
RIP RegPwn
2 parents 5cdbae0 + c17211a commit 67c7b5c

4 files changed

Lines changed: 98 additions & 0 deletions

File tree

‎src/SUMMARY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,7 @@
288288
- [Semanagevolume Perform Volume Maintenance Tasks](windows-hardening/windows-local-privilege-escalation/semanagevolume-perform-volume-maintenance-tasks.md)
289289
- [Service Triggers](windows-hardening/windows-local-privilege-escalation/service-triggers.md)
290290
- [Telephony Tapsrv Arbitrary Dword Write To Rce](windows-hardening/windows-local-privilege-escalation/telephony-tapsrv-arbitrary-dword-write-to-rce.md)
291+
- [Secure Desktop Accessibility Registry Propagation LPE (RegPwn)](windows-hardening/windows-local-privilege-escalation/secure-desktop-accessibility-registry-propagation-regpwn.md)
291292
- [Uiaccess Admin Protection Bypass](windows-hardening/windows-local-privilege-escalation/uiaccess-admin-protection-bypass.md)
292293
- [Windows C Payloads](windows-hardening/windows-local-privilege-escalation/windows-c-payloads.md)
293294
- [Active Directory Methodology](windows-hardening/active-directory-methodology/README.md)

‎src/windows-hardening/windows-local-privilege-escalation/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ UIAccess processes launched through `RAiLaunchAdminProcess` can be abused to rea
5050
uiaccess-admin-protection-bypass.md
5151
{{#endref}}
5252

53+
Secure Desktop accessibility registry propagation can be abused for an arbitrary SYSTEM registry write (RegPwn):
54+
55+
{{#ref}}
56+
secure-desktop-accessibility-registry-propagation-regpwn.md
57+
{{#endref}}
58+
5359
## System Info
5460

5561
### Version info enumeration

‎src/windows-hardening/windows-local-privilege-escalation/secure-desktop-accessibility-registry-propagation-regpwn.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Secure Desktop Accessibility Registry Propagation LPE (RegPwn)
2+
3+
{{#include ../../banners/hacktricks-training.md}}
4+
5+
## Overview
6+
7+
Windows Accessibility features persist user configuration under HKCU and propagate it into per-session HKLM locations. During a **Secure Desktop** transition (lock screen or UAC prompt), **SYSTEM** components re-copy these values. If the **per-session HKLM key is writable by the user**, it becomes a privileged write choke point that can be redirected with **registry symbolic links**, yielding an **arbitrary SYSTEM registry write**.
8+
9+
The RegPwn technique abuses that propagation chain with a small race window stabilized via an **opportunistic lock (oplock)** on a file used by `osk.exe`.
10+
11+
## Registry Propagation Chain (Accessibility -> Secure Desktop)
12+
13+
Example feature: **On-Screen Keyboard** (`osk`). The relevant locations are:
14+
15+
- **System-wide feature list**:
16+
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs`
17+
- **Per-user configuration (user-writable)**:
18+
- `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk`
19+
- **Per-session HKLM config (created by `winlogon.exe`, user-writable)**:
20+
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Session<session id>\ATConfig\osk`
21+
- **Secure desktop/default user hive (SYSTEM context)**:
22+
- `HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk`
23+
24+
Propagation during a secure desktop transition (simplified):
25+
26+
1. **User `atbroker.exe`** copies `HKCU\...\ATConfig\osk` to `HKLM\...\Session<session id>\ATConfig\osk`.
27+
2. **SYSTEM `atbroker.exe`** copies `HKLM\...\Session<session id>\ATConfig\osk` to `HKU\.DEFAULT\...\ATConfig\osk`.
28+
3. **SYSTEM `osk.exe`** copies `HKU\.DEFAULT\...\ATConfig\osk` back to `HKLM\...\Session<session id>\ATConfig\osk`.
29+
30+
If the session HKLM subtree is writable by the user, step 2/3 provide a SYSTEM write through a location the user can replace.
31+
32+
## Primitive: Arbitrary SYSTEM Registry Write via Registry Links
33+
34+
Replace the user-writable per-session key with a **registry symbolic link** that points to an attacker-chosen destination. When the SYSTEM copy occurs, it follows the link and writes attacker-controlled values into the arbitrary target key.
35+
36+
Key idea:
37+
38+
- Victim write target (user-writable):
39+
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Session<session id>\ATConfig\osk`
40+
- Attacker replaces that key with a **registry link** to any other key.
41+
- SYSTEM performs the copy and writes into the attacker-chosen key with SYSTEM permissions.
42+
43+
This yields an **arbitrary SYSTEM registry write** primitive.
44+
45+
## Winning the Race Window with Oplocks
46+
47+
There is a short timing window between **SYSTEM `osk.exe`** starting and writing the per-session key. To make it reliable, the exploit places an **oplock** on:
48+
49+
```
50+
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml
51+
```
52+
53+
When the oplock triggers, the attacker swaps the per-session HKLM key for a registry link, lets the SYSTEM write land, then removes the link.
54+
55+
## Example Exploitation Flow (High Level)
56+
57+
1. Get current **session ID** from the access token.
58+
2. Start a hidden `osk.exe` instance and sleep briefly (ensure the oplock will trigger).
59+
3. Write attacker-controlled values to:
60+
- `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk`
61+
4. Set an **oplock** on `C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml`.
62+
5. Trigger **Secure Desktop** (`LockWorkstation()`), causing SYSTEM `atbroker.exe` / `osk.exe` to start.
63+
6. On oplock trigger, replace `HKLM\...\Session<session id>\ATConfig\osk` with a **registry link** to an arbitrary target.
64+
7. Wait briefly for the SYSTEM copy to complete, then remove the link.
65+
66+
## Converting the Primitive to SYSTEM Execution
67+
68+
One straightforward chain is to overwrite a **service configuration** value (e.g., `ImagePath`) and then start the service. The RegPwn PoC overwrites the `ImagePath` of **`msiserver`** and triggers it by instantiating the **MSI COM object**, resulting in **SYSTEM** code execution.
69+
70+
## Related
71+
72+
For other Secure Desktop / UIAccess behaviors, see:
73+
74+
{{#ref}}
75+
uiaccess-admin-protection-bypass.md
76+
{{#endref}}
77+
78+
## References
79+
80+
- [RIP RegPwn](https://www.mdsec.co.uk/2026/03/rip-regpwn/)
81+
- [RegPwn PoC](https://github.com/mdsecactivebreach/RegPwn)
82+
83+
{{#include ../../banners/hacktricks-training.md}}

‎src/windows-hardening/windows-local-privilege-escalation/uiaccess-admin-protection-bypass.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,14 @@ Get-AccessibleFile -Win32Path $paths -Access Execute,WriteData `
5252
- Run as Administrator for broader visibility; set `-ProcessId` to a low-priv process to mirror that token’s access.
5353
- Filter manually to exclude known disallowed subdirectories before using candidates with `RAiLaunchAdminProcess`.
5454

55+
## Related
56+
57+
Secure Desktop accessibility registry propagation LPE (RegPwn):
58+
59+
{{#ref}}
60+
secure-desktop-accessibility-registry-propagation-regpwn.md
61+
{{#endref}}
62+
5563
## References
5664
- [Bypassing Administrator Protection by Abusing UI Access](https://projectzero.google/2026/02/windows-administrator-protection.html)
5765
- [GetProcessHandleFromHwnd (GPHFH) Deep Dive](https://projectzero.google/2026/02/gphfh-deep-dive.html)

0 commit comments

Comments
 (0)