Breaking Barriers and Assumptions: Techniques for Privilege Escalation on Windows: Part 2

This report analyzes a local privilege escalation technique targeting ESET Smart Security's `ekrn.exe`. By writing an EICAR test string to an alternate data stream, polling for `FILE_ATTRIBUTE_NORMAL`, and then creating an Object Manager symbolic link combined with an NTFS junction, an attacker-controlled deletion by `ekrn.exe` can be redirected to `C:\Config.msi`, enabling escalation to `NT AUTHORITY\SYSTEM`.