Post B6R360ZPOJ61qEzOnA by wdormann@infosec.exchange
 (DIR) More posts by wdormann@infosec.exchange
 (DIR) Post #B6R360ZPOJ61qEzOnA by wdormann@infosec.exchange
       0 likes, 0 repeats
       
       New from Nightmare-Eclipse, we have MiniPlasmaWorks reliably to get a SYSTEM cmd.exe prompt on Win11 (including 26H1) with May's updates.  Is reportedly a failure to properly fix CVE-2020-17103.  I'll note that it does not seem to work on the latest Insider Preview Canary Windows 11.
       
 (DIR) Post #B6R360nEYu9gX7SRLE by wdormann@infosec.exchange
       1 likes, 0 repeats
       
       The Nightmare-Eclipse repo clearly credits James Forshaw with the CVE-2020-17103 vulnerability that MiniPlasma is based off of.Did Nightmare-Eclipse modify MiniPlasma to use a variant of CVE-2020-17103 that still works on modern Windows, which surely contains the fix?NO.  MiniPlasma IS the poc from the GPZ write-up, but with a minor tweak to do something (LPE).Why does it work on current Windows?Well, instead of fixing CVE-2020-17103, they decided to break the PoC instead. And yeah, with Win10 Dec 2020 and Win11 RTM, the GPZ PoC doesn't work.But somewhere between Win11 RTM and 22H2 (I have neither the VM snapshots nor the patience to determine when exactly), whatever thing Microsoft did to break the CVE-2020-17103 PoC regressed.  An because it wasn't a fix, then surely Microsoft had no regression test to detect that the fix was no longer present.So here we are.  MiniPlasma is the GPZ PoC, but modified slightly to achieve LPE instead of creating DEMODEMO in the registry.Since Microsoft didn't bother fixing CVE-2020-17103, will CVE-2020-17103 simply be updated with the MiniPlasma recognition that it wasn't actually fixed in December 2020?  Get real.  This will surely get a new CVE, as CVEs are for Microsoft updates, not vulnerabilities.  😂