Windows 0-day abandoned by disgruntled researcher hands hackers back to system rights

The researcher continues:

What makes it funnier is the fact that it can be used against any antimalware engine to bypass its self-defense (or tamper protection) mechanism, since you can trigger the creation of arbitrary files in the context of their own antimalware process. So from the perspective of their kernel drivers, the file creation request comes from their own legitimate process and therefore passes through, which makes this vulnerability unique as it can be used to disable any antivirus/EDR.

Nightmare Eclipse said the exploit worked against Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental. Users can see if their systems are vulnerable by checking the CLFS authentication mode. If it is in learning mode or application mode, the system is vulnerable and the PoC provided in the article should generate a SYSTEM shell. Nightmare Eclipse has released many other Windows zero-days in recent months.

Researcher Will Dormann said in an interview that he managed to reproduce the exploit and that it worked as described, although not on all versions of Windows 11. But there is a catch, he said.

“The requirements are significant in that they appear to require Windows 26H2, which has been around for over 90 days, it seems,” he explained. “In other words, you can’t just take a new 26H2 system, install updates and make it work. »

For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode
the value must be 0 or 1.” Of the many machines used by Dormann, only one met this requirement.

Microsoft does staged rollouts of Windows updates, such as 26H2, so it’s not clear how many people have them. You can check by running the “winver” command. Microsoft representatives did not respond to an email seeking comment.