Breaking Barriers and Assumptions: Techniques for Privilege Escalation on Windows: Part 1

This report explains link-following (CWE-59) vulnerabilities on Windows where applications transparently follow NTFS junctions, hard links, or symlinks, enabling attackers to redirect privileged file operations. It outlines scouting methods (using Procmon to find writable locations and sensitive file operations), exploitation prerequisites, and observed mitigations (FILE_FLAG_OPEN_REPARSE_POINT, checking reparse tags, protected files, impersonation, and Redirection Guard), focusing on how developers can detect and reduce this class of vulnerability.