Local Privilege Escalation

Title	Vulnerabilities	Programs	Authors
CVE-2023-23525: Get Root via A Fake Installer	Local Privilege Escalation	Apple (MacOS)	Mickey Jin (@Patch1t)
The Fuzzing Guide to the Galaxy: An Attempt with Android System Services	Android Fuzzing Heap Overflow Integer Overflow Out-of-Bounds Write Memory Corruption Local Privilege Escalation	Samsung	Anthony Remy
Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 2	Local Privilege Escalation TOCTOU Arbitrary File Write	Docker	Eviatar Gerzi
CVE-2023-29383: Abusing Linux chfn to Misrepresent /etc/passwd	Local Privilege Escalation	Shadow-Utils	Tom Neaves
Bash Privileged-mode Vulnerabilities In Parallels Desktop And CDPATH Handling In MacOS	MacOS Local Privilege Escalation	Parallels	Reno Robert (@Renorobertr)
Microsoft Intune, Version 1.55.48.0 Advisory	Unquoted Search Path Local Privilege Escalation	Microsoft (Intune)	Ben Lincoln (@0x00C651E0)
Windows Task Scheduler Application, Version 19044.1706 Advisory	Unquoted Search Path Local Privilege Escalation	Microsoft (Windows)	Ben Lincoln (@0x00C651E0)
CyberGhostVPN - the story of finding MITM, RCE, LPE in the Linux client	RCE MiTM Local Privilege Escalation	CyberGhost	Mmmds
Dynamic Linking Injection and LOLBAS Fun	DLL Hijacking Dynamic-Linking Injection Local Privilege Escalation	Undisclosed	Joseph Henry
Getting Root - A Technical Walkthrough	Information Disclosure LFI RCE Local Privilege Escalation	Undisclosed	OccamSec (@Occamsec)
Windows Installer EOP (CVE-2023-21800)	Local Privilege Escalation	Microsoft (Windows)	Adrian Denkiewicz
Your Browser is Not a Safe Space	Local Privilege Escalation Lateral Movement	Undisclosed	Corey Ham
Veeam Backup and Replication CVE-2023-27532 Deep Dive	Local Privilege Escalation	Veeam	James Horseman (@JamesHorseman2)
Leveraging ssh-keygen for Arbitrary Execution (and Privilege Escalation)	Local Privilege Escalation IoT	Undisclosed	Sean Pesce (@SeanPesce)
Bypass TCC via iCloud	TCC Bypass Local Privilege Escalation	Apple (MacOS)	Wojciech Reguła (@_R3ggi)
From CVE-2022-33679 to Unauthenticated Kerberoasting	Kerberos MiTM Local Privilege Escalation Downgrade Attack	Microsoft (Windows)	Trampas Howe (@Trampashowe)
Give me a browser, I’ll give you a Shell	Local Privilege Escalation Kiosk Hacking	Undisclosed	Rend
Multiple vulnerabilities in Nokia BTS Airscale ASIKA	Base Transceiver Station Path Traversal Hardcoded Private Key Local Privilege Escalation Security Misconfiguration	Nokia	Geoffrey Bertoli (@YofBalibump) Lena David (@_Lemeda)
Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS	Local Privilege Escalation	Apple (MacOS)	Austin Emmitt (@Alkalinesec)
Disabling ClamAV as an Unprivileged User	Local Privilege Escalation	ClamAV	Arch Cloud Labs (@DLL_Cool_J)
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955	Local Privilege Escalation	Microsoft (Windows)	Ap (@Decoder_it)
Readline crime: exploiting a SUID logic bug	Local Privilege Escalation	Arch Linux Util-Linux	Roddux
LPE via StorSvc	Local Privilege Escalation DLL Hijacking	Microsoft (Windows)	Antón Ortigueira (@Antuache) Kurosh Dabbagh (@_Kudaes_)
LocalPotato - When Swapping The Context Leads You To SYSTEM	Windows NTLM Local Privilege Escalation	Microsoft	Andrea Pierini (@Decoder_it)
Elevation of privileges from Everyone through Avast Sandbox to System AmPPL (CVE-2021-45335, CVE-2021-45336 and CVE-2021-45337)	Local Privilege Escalation	Avast	Denis Skvortcov (@Denis_Skvortcov)

Page 4 of 10