Old Windows quirks help punch through new admin defenses

Microsoft patched nine vulnerabilities in the newly introduced Windows Administrator Protection feature disclosed by Google Project Zero researcher James Forshaw; the flaws could allow a local attacker to escalate to admin by manipulating DOS device object directory creation and impersonating a shadow admin token. The issues primarily relate to Logon Sessions and token handling and were mitigated by preventing directory creation when impersonating the shadow admin token; the feature is not yet generally available (limited to Insider Canary) and there are no reported in-the-wild exploits.