Privilege Escalation
11 matching posts.
The Helper Was Registered. Its Lifetime Outlived the App.
A macOS login item, launch agent, or launch daemon can remain active after the visible app exits. A defensible review separates packaging, registration, approval, launch domain, runtime authority, updates, failure recovery, and removal.
The App Was Sandboxed. The XPC Boundary Still Needed Authorization.
A macOS app can be sandboxed while a separate helper, launch agent, or launch daemon holds different authority. A defensible review maps every executable, entitlement, XPC peer, operation, and effect instead of treating the app bundle as one security boundary.
The Extension Was Sandboxed. The Native Host Was Not.
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
Three False Alarms in a Privileged Helper Sweep
Seven third-party helpers run as root on this Mac. I checked whether each one authenticates the process talking to it, was wrong three times in a row, and found nothing. The interesting part is why each cheap method failed.
The Container Was Non-Root. The Node Was Still One Mount Away.
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
The Hardening Score Went Up. The Attack Path Stayed Open.
A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.
AD CS ESC4: The Template Nobody Owned
How an ordinary AD CS permission becomes Domain Admin — and why ESC4 is the cause every ESC1 write-up skips.
Affiliates Do Not Find Novel Paths. They Find Yours.
Part three of testing the ransomware playbook: privilege escalation inside the domain uses a small, stable set of paths — the same ones already written up on this site — and the affiliate picks by reliability, not by cleverness.
Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.
CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.
BloodHound Path Triage: The Shortest Path Is Usually the One That Expires First
BloodHound draws every edge the same width, but a DACL lasts for years and a session lasts for minutes. Shortest-path queries are biased toward exactly the edges least likely to still be there when you walk them.
Delegation Triage: You Were Taught the Rare One
Unconstrained delegation gets the diagrams. Resource-based constrained delegation is what you actually find — because it is not a checkbox anyone audits, it is a side effect of who can write to a computer object.