BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidescbr.com.au//bsides-canberra-2026//speaker//WT
 SVRF
BEGIN:VTIMEZONE
TZID:Australia/Sydney
BEGIN:STANDARD
DTSTART:20250924T000000
TZNAME:AEST
TZOFFSETFROM:+1000
TZOFFSETTO:+1000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20251005T030000
RDATE:20261004T030000
TZNAME:AEDT
TZOFFSETFROM:+1000
TZOFFSETTO:+1100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20260405T030000
RDATE:20270404T030000
TZNAME:AEST
TZOFFSETFROM:+1100
TZOFFSETTO:+1000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Troubleshooting to SYSTEM: Local Privilege Escalation in Windows D
 iagnostics - Ben Wilson
DTSTART;TZID=Australia/Sydney:20260924T100000
DTEND;TZID=Australia/Sydney:20260924T105500
DTSTAMP:20260807T131249Z
UID:pretalx-bsides-canberra-2026-H8HCDM@cfp.bsidescbr.com.au
DESCRIPTION:Windows Diagnostics is easy to overlook. To most users it appe
 ars as a combination of troubleshooters and recovery actions that sometime
 s solve problems. Under the hood is a privileged automation framework that
  can restart services\, trigger system shutdowns and run scripts and binar
 ies as SYSTEM.\n\nThis research uncovered three new local privilege escala
 tion exploits by following how user input inside help applications is turn
 ed into privileged diagnostic execution. I walk through how I mapped that 
 execution flow\, separated legacy and modern backends and identified where
  normal repair workflows cross security boundaries.\n\nThe talk then explo
 res individual diagnostic packages. I review package logic to identify att
 acker-controlled inputs\, privileged operations and signature checks\, the
 n use those details to spot candidate vulnerable code patterns. I show how
  those candidates were tested with custom diagnostic clients from a standa
 rd user context. The talk finishes with a deep case study of one local pri
 vilege escalation exploit in a Windows diagnostic action\, covering the co
 nditions that made it exploitable and how a standard user-controlled repai
 r path could be turned into SYSTEM code execution.
LOCATION:Main Track
URL:https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/H8HCDM/
END:VEVENT
END:VCALENDAR