FalconFlank CrowdStrike Falcon Macro-Remediation Race and DL...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/MSNightmare/FalconFlank
• Blog Title: FalconFlank: CrowdStrike Falcon Macro-Remediation Race and DLL Side-Loading Privilege Escalation
• Suggested Section: Windows Hardening > Windows Local Privilege Escalation > Reparse-Point and Oplock TOCTOU Races Against Privileged Services, with a cross-reference under DLL Hijacking / DLL Side-Loading

🎯 Content Summary

FalconFlank is a public C++ proof-of-concept for a claimed zero-day Windows local privilege-escalation vulnerability in the CrowdStrike Falcon Sensor. It chains Falcon's privileged Microsoft Office malicious-macro remediation, an oplock-coordinated path-switch race using a mount-point reparse point, an unintended write to PowerShell's protected installation directory, and DLL side-loading through a scheduled task. Source code, embedded payloads, Visual Studio project files, a...

🔧 Technical Details

Reparse-point race against privileged remediation: when a privileged security service scans and later modifies an attacker-controlled pathname, an attacker can coordinate access with an oplock, remove part of the original directory tree, and replace a parent directory with a mount-point reparse point. If the service resolves the pathname again without validating that it still refers to the original objects, its remediation operation follows the junction into an attacker-selected protected directory. This converts a benign privileged file operation into an arbitrary protected-path modification primitive.

Disguising the remediation trigger as the desired target filename: a malicious Office document does not need an Office extension if the scanner identifies content independently of the filename. The PoC stores an OLE macro document under the name bcrypt.dll. After the parent path is redirected, the privileged workflow operates ...

🤖 Agent Actions

Plan:

1. Inspect the Windows privilege-escalation and DLL-loading documentation and compare at least five relevant pages.
2. Verify the FalconFlank source and any authoritative Windows API details needed for a concise, generalized technique.
3. Edit only the best-fitting existing page, preserving its style and reference numbering.
4. Validate the diff, links, citations, and Markdown structure.
   Repository review is complete. The existing Object Manager race page is the best fit because it already documents oplock-assisted filesystem races and privileged-remediation path switching; I’ll add one generalized applied chain there and only a link from the DLL-hijacking page.
   The documentation changes are in place. I’m now validating the internal anchor, citation numbering, external references, diff cleanliness, and book build availability.
   Updated the HackTricks repository:

• Added a generalized FalconFlank technique section covering:
  • Oplock-coordinated TOCTOU synchronization
  • Mount-point reparse redirection
  • Privileged remediation as a confused deputy
  • Transactional DLL replacement
  • Scheduled-task DLL side-loading
  • Detection pivots and PoC reliability defects
• Added numbered citations to the pinned FalconFlank source, repository, and Microsoft documentation.
• Added a DLL-hijacking cross-reference.
• Preserved the unverified/build-dependent status of the product-specific claim.

Validation:

• git diff --check passed.
• All added external references returned HTTP 200.
• Citation numbering and internal link target validated.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/MSNightmare/FalconFlank

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Windows Local Privilege Escalation > Reparse-Point and Oplock TOCTOU Races Against Privileged Services, with a cross-reference under DLL Hijacking / DLL Side-Loading".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0