RegPwn — Windows Accessibility registry-symlink LPE PoC (CVE...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/mdsecactivebreach/RegPwn
• Blog Title: RegPwn — Windows Accessibility registry-symlink LPE PoC (CVE-2026-24291)
• Suggested Section: Windows Hardening -> Windows Local Privilege Escalation (new entry: "Windows Registry Symbolic Links (REG_LINK) + Oplocks for LPE"; reference CVE-2026-24291 / ATBroker Accessibility)

🎯 Content Summary

What this repository is

RegPwn is a C# proof-of-concept exploit repository for a Windows local privilege escalation (LPE) tracked as CVE-2026-24291, affecting the Windows Accessibility infrastructure (referenced as ATBroker.exe in the provided summary). The repo README states it is the exploit for the MDSec blog post “RIP RegPwn” and that it targets Windows client and server builds.

Repo reference (kept):
https://github.com/mdsecactivebreach...

🔧 Technical Details

Registry symlink (REG_LINK) redirection to force privileged writes into attacker-chosen HKLM paths: If you can win a timing window around a privileged component’s registry access, delete the privileged key and immediately recreate it using RegCreateKeyExW with REG_OPTION_CREATE_LINK | REG_OPTION_VOLATILE. Then set SymbolicLinkValue (type REG_LINK, 0x00000006) to an NT registry path like \\Registry\\Machine\\SYSTEM\\.... Subsequent privileged operations against the original key are transparently redirected to the target, potentially allowing modification of protected registry values (often convertible to code execution/LPE when targeting service configuration, startup extensibility points, etc.).

Oplock-assisted race reliability: To make a fragile race deterministic, place an exclusive oplock on a file the victim component must open (e.g., a configuration XML). Use OplockExclusiveA...

🤖 Agent Actions

Summary: Added a new “Registry symbolic links (REG_LINK) + oplock-assisted race” technique section to Windows LPE and appended RegPwn references.

Files changed:

• src/windows-hardening/windows-local-privilege-escalation/README.md

Tests not run (not requested).

Next steps:

1. If you want, I can add a short detection/telemetry note for REG_LINK creation and SymbolicLinkValue writes in the same section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/mdsecactivebreach/RegPwn

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Windows Local Privilege Escalation (new entry: "Windows Registry Symbolic Links (REG_LINK) + Oplocks for LPE"; reference CVE-2026-24291 / ATBroker Accessibility)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0