Privileged Filesystem Trust-Boundary Auditor

by Zero Science Lab

Find the Windows bug class where a high-integrity process trusts a path, file, or directory that a standard user can influence - arbitrary delete/write/rename, DLL planting, weak ACLs, junction redirection, TOCTOU swaps, and cross-privilege data flow - then prove it with a harmless canary, never a payload.

Bug classes it surfaces: TOCTOU (check→use) races · local privilege escalation · arbitrary file write / delete / rename · junction & reparse-point redirection · DLL / binary planting (code-execution vectors) · weak-ACL privileged artifacts - each surfaced from real evidence and, where supported, proven with a benign canary at standard-user privilege (Lift demonstrates the vector; it never runs a payload).

Lift records what installers, updaters, repair services, brokers, and other elevated programs actually do to the filesystem, turns that into a short list of ranked findings with exact evidence (the token, the integrity level, the ACE that grants a standard user write), and lets you verify a finding on the spot with a benign proof that runs at your real standard-user privilege - because a proof only counts if the account you claim can do it actually does it.

It is a security auditor, and it can be intrusive on purpose - but every active probe is a benign canary (a marker file, a proof-of-load DLL, a junction pointing at a Lift canary), never a weaponized exploit, and every intrusive step is confirmed and reversible.

---

What Lift does, in one loop

Scan / Trace  →  Analyze  →  Assess  →  Prove  →  (Export)

1. Scan the machine for SYSTEM services that consume user-writable locations, or Trace a program / service live via a kernel ETW session.
2. Analyze the captured file operations into ranked findings with real ACL evidence.
3. Assess a finding - Lift confirms a privileged actor, a redirectable operation, and a path component a standard user genuinely controls.
4. Prove it - plant a benign canary (content, module, or a redirect junction) as your standard-user token and confirm it landed. Restore afterward.
5. Export a vendor-ready HTML report.

---

Features

Capture

• Live ETW recording of kernel FileIO + Process + ImageLoad - no driver, no hooks.
• Trace program - launch a target and record its process tree.
• Record a service as SYSTEM - start a stopped service under its real account with the session already live, so its startup activity is captured as SYSTEM, not as a user-launched copy.
• Attach to a running PID.
• Live feed while recording - a pulsing indicator, a running captured / in-target-tree counter, and a rolling tail of the most recent operations (cheap ring-buffer polling, no per-event UI cost).
• Import existing traces: Lift JSONL or Process Monitor CSV.

Target discovery (Scan)

• Enumerates LocalSystem services and flags the ones with a user-writable ProgramData directory (a lead to record, not a confirmed bug).
• Loaded-module scanner - flags modules that running processes loaded from low-privilege writable paths (\ProgramData\, \AppData\, \Users\Public\, \Windows\Temp\), with owner and integrity.
• Quote-aware service ImagePath parsing, authoritative service PID via the SCM, and scheduled-task discovery.

Analysis - finding categories

• CrossPrivilegeDataFlow - an unprivileged write is later read/loaded/executed by a privileged actor (the headline signal).
• PrivilegedInputFromWritablePath - a high-integrity process reads input from a path a standard user can write.
• PrivilegedImageLoadFromWritablePath / PrivilegedProcessFromWritableImage - a privileged process loads or executes an image from a user-writable location (DLL/binary planting).
• PrivilegedDeleteInWritableTree / PrivilegedWriteInWritableTree - privileged destructive or write operations beneath a user-controllable tree.
• WeakAclPrivilegedArtifact - a privileged artifact left modifiable by a low-privilege principal.
• SensitiveDestinationWrite - writes into protected destinations for context.
• Reparse-point traversal and object-identity (file-ID) change correlation.

Findings carry Severity and Confidence separately. Confidence is your triage tell: Strong = the real ACL confirmed it; Moderate/Tentative = heuristic only. Live recordings use the measured ACL (not a path-prefix guess), so hardened ProgramData subdirs are not mislabelled writable.

Verification & proofs (benign, de-elevated)

• Assess redirectability - read-only: confirms a privileged actor, a redirectable operation, and the exact path component a standard user controls, with a per-component breakdown and the granting ACE.
• Attempt proof (benign canary) - content-injection findings: writes a canary marker into the file the privileged process reads and reads it back → PROVEN. If the exact file is SYSTEM-owned, it falls back to a directory plant (proves you can drop input files in that folder).
• Module-plant proof - plants a benign canary in a privileged module's writable directory.
• Embedded proof-of-load canaries - ships a benign .exe (records whoami /all + the token it ran under) and .dll (marks on DllMain) for confirming a privileged load/exec.
• Redirect race (write/create/delete findings) - plants a junction at a user-controllable component that does not exist yet, pointing at a harmless Lift canary; if the privileged workflow writes through it, the operation lands in the canary → PROVEN. Non-destructive (create-only, never moves real data) and removed on Restore. The destructive "replace an existing real directory" case stays VM-only by design.
• Every active probe runs as your real standard-user token (de-elevated via the shell token even when Lift is elevated), and reports the acting user + integrity - so a green PROVEN genuinely reflects standard-user rights, not Lift's admin.

Reporting

• Standalone, self-contained HTML report export.
• Deterministic finding IDs (LIFT-XXXXXXXX).

---

The GUI

Run Lift.exe. Elevation is needed for recording/scanning (kernel ETW); the interaction side de-elevates itself.

Header - Scan targets · Trace program · Load JSONL · Load ProcMon CSV · Load sample · Export HTML report · ? (About).

Two panes:

• Left - findings list. Sortable columns: Severity · Category · User · Path · Op · Process · Confidence (click any header to sort; Severity sorts by risk level). Severity is shown in a desaturated risk color. Right-click a row for Assess redirectability · Copy path · Copy full details · Open containing folder. Drag the divider to widen either pane.
• Right - status over probing.
  • STATUS: the ratings row (Total / Crit / High / Med / Low) and an UNDER AUDIT card showing the single target you recorded and the accounts it ran as (not the whole system-wide trace).
  • PROBING: a selected finding, with the action buttons pinned at the top (Assess / Attempt proof / Read proof / Restore) and the result right below them, then the scrollable detail (summary, actor & operation, evidence, safe next step, remediation).

Filter box - type to filter findings by process, path, or category.

While recording - a compact overlay with a pulsing red dot, Recording…, the live capture counter, a rolling op tail, and Stop recording (recording is stop-driven; no timer).

All detail text is selectable/copyable.

---

The CLI (lift.exe)

lift analyze --input <trace.jsonl|.csv> --report <report.html> [--lab-root C:\LiftLab]
lift record  --target "C:\path\setup.exe" [--args "/S"] [--duration 60] --output trace.jsonl [--report r.html]
lift record  --pid 1234 [--duration 30] --output trace.jsonl
lift scan
lift probe
lift diag    [--duration 8]
lift verify  --confirm-lab [--lab-root C:\LiftLab] [--iterations 20] [--oplock]
lift demo    --output lift-demo.jsonl --report lift-demo-report.html

Command	What it does
analyze	Analyze a JSONL or ProcMon CSV trace into a ranked HTML report.
record	Live ETW capture of a launched program (--target) or an existing PID (--pid). Requires Administrator.
scan	Enumerate SYSTEM-service candidates + writable-path / loaded-module leads on this machine.
probe	Show the identity the interaction/proof steps run under (verifies de-elevation), with a live write test.
diag	System-wide ETW sanity check - raw callback count + sample events (isolates "is ETW delivering file events?").
verify	Confined active canary self-test in C:\LiftLab (proves the redirection/oplock primitive works, harmlessly). Needs --confirm-lab.
demo	Emit a synthetic sample trace + report (no machine access).

record and scan require an elevated prompt; analyze, probe, and demo do not.

---

Safety model

• Benign canaries only - a marker file, a proof-of-load DLL/EXE (records the token it ran under), or a junction to a Lift canary directory. No payloads, no privilege escalation, no detection-evasion.
• Proofs run de-elevated - as your standard-user token, so success reflects real standard-user rights.
• Confined active verifier - lift verify creates and cleans up canaries only beneath the lab root, never system paths, and hard-fails if confinement can't be proven.
• Non-destructive redirect race - create-only; it never moves or replaces real directory state, and removes the junction on Restore. The destructive replace case is deliberately left VM-only.
• Confirm-and-reverse - every intrusive action prompts first and backs up / restores what it touches.

Use Lift only on systems you own or are authorized to assess. Prefer a disposable VM with a snapshot for active verification. See SECURITY.md.

---

Build & run

Requirements: Windows 10/11 (x64 or x86), .NET 8 SDK. The managed app is AnyCPU (runs 64- or 32-bit); live recording and scanning need an elevated (Administrator) session.

# build everything
dotnet build Lift.sln -c Release

# GUI
dotnet run --project src\Lift.Gui

# CLI
dotnet run --project src\Lift.Cli -- <command> [options]

# example: analyze a trace
dotnet run --project src\Lift.Cli -- analyze --input samples\demo-trace.jsonl --report report.html

The GUI project builds to Lift.exe; the CLI to lift.exe.

---

Prior art & honest boundaries

Lift does not invent this bug class. TOCTOU races, junction/reparse redirection, and oplock-assisted swaps have been researched and tooled for years (Project Zero's symboliclink-testing-tools, NtObjectManager, Attack Surface Analyzer, SetupHijack, USENIX 2003, and many per-CVE PoCs). Lift's contribution is automation and safe, standard-user verification - the usability of a DLL-hijacking auditor applied to filesystem trust-boundary bugs. Full credit and the claim boundaries are in docs/RELATED-WORK.md.

---

Project principle

Detect the dangerous trust boundary. Prove it with a harmless canary, as the real standard user. Never require weaponization to make the finding understandable.

---

License & credits

Lift is developed by Zero Science Lab and released under the GNU General Public License v3.0 - see LICENSE. (c) 2026 Zero Science Lab.

You may use, study, modify, and redistribute Lift freely; any distributed derivative must also be released under the GPLv3 - it cannot be made closed-source.

Prior-art credit for the underlying vulnerability class is in docs/RELATED-WORK.md.