Windows Exploitation Technique Amplifying Race Windows via S... #1681
+118
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🤖 Automated Content Update
This PR was automatically generated by the HackTricks News Bot based on a technical blog post.
📝 Source Information
🎯 Content Summary
This post documents a generic Windows kernel exploitation trick: amplifying race-condition windows by deliberately slowing down the Object Manager Namespace (OMNS) lookup of attacker-controlled named objects. The author originally developed this in 2016 and revalidated it on a modern Windows 11 24H2 (Surface Pro, Snapdragon X Elite 3.40GHz).
Background: Typical Windows race-condition pattern
Many Windows kernel vulnerabilities follo...
🔧 Technical Details
Trick 1 – Exploiting UNICODE_STRING length for slow single-component lookups:
Windows Object Manager paths are stored in
UNICODE_STRINGstructures with a 16-bitLengthfield, limiting paths to ~32767 UTF-16 characters. An attacker can create a named object (e.g. event) in a writable directory like\BaseNamedObjectsusing a single extremely long component (e.g.\BaseNamedObjects\A[~32k chars]). When vulnerable code invokesNtOpenX()on that name, the kernel must perform a full Unicode string comparison to match the component in the directory. This yields roughly linear growth in lookup time with name length, slowing calls from ~2 μs (normal names) to ~35 μs at maximum length. For any race pattern ofcheck() -> NtOpenX(long_name) -> secure_action(), this directly increases the race window by an order of magnitude without special privileges.Trick 2 – ...
🤖 Agent Actions
Summary:
Testing:
This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.
📚 Repository Maintenance
All .md files have been checked for proper formatting (headers, includes, etc.).