Tcm Security Windows Privilege Escalation -

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated=1 HKCU\... same reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2.4 Unpatched Kernel Exploits (e.g., PrintNightmare, ZeroLogon) Cloud instances often lag behind on patching. TCM tenants relying on default Tencent Cloud images may miss critical updates.

PrintNightmare (CVE-2021-34527) allows remote code execution and local privilege escalation via the Print Spooler service. 2.5 Cloud Metadata Credential Theft From a low-privileged shell on a TCM Windows instance, an attacker can query the instance metadata service: tcm security windows privilege escalation

Invoke-RestMethod -Uri "http://metadata.tencentyun.com/latest/meta-data/cam/security-credentials/" If the instance is assigned a , the returned temporary credentials (SecretId, SecretKey, Token) allow privilege escalation outside the instance to other Tencent Cloud resources (COS, CVM, VPC). 3. Enumeration Methodology (TCM Recommended) A structured approach for Windows privilege escalation assessment: the returned temporary credentials (SecretId