windows-boundaries

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

Windows Security Boundaries

When to Activate

• Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)
• Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers
• Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive
• Defeating PPL to dump LSASS or tamper with EDR self-defense
• Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse
• UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
win32k / dxgkrnl UAF → kernel R/W → token steal	T1068	CWE-416	references/kernel-user-boundary.md	scripts/ioctl_fuzzer.py
Driver IOCTL abuse (METHOD_NEITHER arb-R/W)	T1068	CWE-781	references/kernel-user-boundary.md	scripts/ioctl_fuzzer.py
BYOVD load + MSR/LSTAR or phys R/W → SYSTEM	T1068, T1543.003	CWE-1188	references/byovd-kernel-rw.md	scripts/byovd_kernel_rw.c
BYOVD EDR-kill (callback nulling)	T1562.001, T1014	CWE-1188	references/byovd-kernel-rw.md	scripts/byovd_kernel_rw.c
UAC bypass — ICMLuaUtil elevated COM moniker	T1548.002	CWE-269	references/integrity-uac-com.md	scripts/uac_com_elevate.cpp
UAC bypass — fodhelper HKCU registry hijack	T1548.002, T1112	CWE-269	references/integrity-uac-com.md	scripts/uac_com_elevate.cpp
AppContainer/LPAC broker abuse / cap over-grant	T1211	CWE-668	references/sandbox-appcontainer-escape.md	scripts/sandbox_escape_probe.py
Chromium/Edge Mojo IPC sandbox escape	T1211	CWE-501	references/sandbox-appcontainer-escape.md