Total Recall Retracing Your Steps Back to NT AUTHORITY\SYSTE...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mdsec.co.uk/2026/02/total-recall-retracing-your-steps-back-to-nt-authoritysystem
• Blog Title: Total Recall: Retracing Your Steps Back to NT AUTHORITY\SYSTEM
• Suggested Section: Windows Hardening > Windows Local Privilege Escalation > Privileged Scheduled Tasks and Arbitrary File Deletion (WNF triggers, junction/Object Manager symlink races, and MSI rollback abuse)

🎯 Content Summary

Overview and security impact

MDSec discovered a Windows 11 local elevation-of-privilege chain in the Microsoft Recall scheduled task \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. The task remains present and exploitable even when Recall is disabled. It runs as NT AUTHORITY\SYSTEM and can be indirectly started by a low-privileged user through a writable Windows Notification Facility (WNF) state. Once started, its cleanup code recursively deletes att...

🔧 Technical Details

Triggering privileged scheduled tasks through writable WNF states: A scheduled task may reject direct or on-demand execution while remaining reachable through automatic triggers. Export the task XML and inspect its WnfStateChangeTrigger entries, configured state names, principal, and COM action. Test whether an unprivileged process can update each state using ZwUpdateWnfStateData. If the WNF state's security descriptor permits the update, changing the state can indirectly start the task in its configured privileged context without Task Scheduler start permissions.

Discovering privileged recursive-deletion primitives: Trace a privileged cleanup operation from an attacker-writable base directory through profile resolution, directory enumeration, shell-item creation, and final deletion. Recursive APIs such as IFileOperation::DeleteItem are dangerous when paths or descendants are controlled by a less-privileg...

🤖 Agent Actions

Updated:

• src/windows-hardening/windows-local-privilege-escalation/README.md

Added concise coverage of:

• WNF-triggered privileged scheduled tasks and XML enumeration.
• ZwUpdateWnfStateData reachability testing.
• Auditing recursive privileged cleanup paths.
• Oplock/junction/Object Manager symlink chaining.
• Nested-directory bypasses of shallow reparse-point validation.
• Handle-relative deletion and runtime decompiler verification guidance.
• Numbered MDSec reference and citations.

Validation completed with git diff --check, citation/reference checks, duplicate checks, and forbidden-source checks. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mdsec.co.uk/2026/02/total-recall-retracing-your-steps-back-to-nt-authoritysystem

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Windows Local Privilege Escalation > Privileged Scheduled Tasks and Arbitrary File Deletion (WNF triggers, junction/Object Manager symlink races, and MSI rollback abuse)".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0