Ben Wilson
Ben is a security consultant at Tanto Security, with over three years of experience conducting security assessments. During this period, Ben has successfully delivered a wide variety of engagements across web applications, external and internal infrastructure, physical security assessments, and advanced red team scenarios.
Recognised for his contribution to the cybersecurity community, Ben has been accepted to speak at numerous conferences around Australia, including BSides Melbourne, BSides Canberra and ADFCSC. He was awarded the Best New Speaker Award at BSides Canberra 2024 for his presentation on email spoofing vulnerabilities within Microsoft Outlook.
You can get in touch with him on LinkedIn: https://www.linkedin.com/in/ben-wilson-b01811208
Session
Windows Diagnostics is easy to overlook. To most users it appears as a combination of troubleshooters and recovery actions that sometimes solve problems. Under the hood is a privileged automation framework that can restart services, trigger system shutdowns and run scripts and binaries as SYSTEM.
This research uncovered three new local privilege escalation exploits by following how user input inside help applications is turned into privileged diagnostic execution. I walk through how I mapped that execution flow, separated legacy and modern backends and identified where normal repair workflows cross security boundaries.
The talk then explores individual diagnostic packages. I review package logic to identify attacker-controlled inputs, privileged operations and signature checks, then use those details to spot candidate vulnerable code patterns. I show how those candidates were tested with custom diagnostic clients from a standard user context. The talk finishes with a deep case study of one local privilege escalation exploit in a Windows diagnostic action, covering the conditions that made it exploitable and how a standard user-controlled repair path could be turned into SYSTEM code execution.