Posts by wdormann@infosec.exchange
(DIR) Post #B5KzeKnl48bbruXSvg by wdormann@infosec.exchange
0 likes, 0 repeats
From the same author as BlueHammer we now have RedSun.This works 100% reliably to go from unprivileged user to SYSTEM against Windows 11 and Windows Server with April 2026 updates, as well as Windows 10, as long as you have Windows Defender enabled.
(DIR) Post #B5p5ymWQ8kCI6IMOcy by wdormann@infosec.exchange
0 likes, 0 repeats
So CopyFail CVE-2026-31431 is a thing.If you're on the Ubuntu platform, 26.04 is not affected. 18.04 through 25.10 are indeed affected, but no fixes are available.If you're on another platform, check with your vendor for update availability.
(DIR) Post #B5p5ymjtKeyMm4f9cm by wdormann@infosec.exchange
0 likes, 0 repeats
If you're using an obscure distro like "Debian", you may not have a fix available.
(DIR) Post #B5p5ymxMWZkRRqxuca by wdormann@infosec.exchange
0 likes, 0 repeats
Or RHEL.I suspect that some people use that?
(DIR) Post #B5p5yn7duLyHxjm7e4 by wdormann@infosec.exchange
1 likes, 2 repeats
While this vulnerability seems to be discovered using AI ("Xint Code"), I have to assume that they also let the AI decide how to do the vulnerability coordination as well.major builds are out as of this writing 😂No distros have official updates for CVE-2026-31431. Fedora 42 and newer have updates, but no official advisory or acknowledgement of CVE-2026-31431. So with them it's unclear if it's even intentional. Red Hat, Ubuntu, Amazon Linux, and Suse all have advisories as of now, but NO updates.disable the algif_aead module as a mitigation. 😂Bespoke distros like RHEL don't use a module, it's compiled into the kernel.I can't figure out what the Xint Code angle is with this copyfail stuff. On one hand, yes, it is a true vulnerability that affects a LOT of Linux distros available. And they did submit the bug for fixing to the upstream kernel people.BUT the CVE has only existed for a week. And NONE of the distros IN THEIR ADVISORY had updates available at the time that they pulled the trigger for publication of the shiny copy.fail website.I struggle to think of how this even happens. In all my years of infosec, you're either on board with doing CVD (e.g. coordinating with the former CERT/CC) or you're not (dropping 0day). But this all fits bizarrely in the middle. The publication gives the guise that they did the right thing, (and please use our AI services). But at the same time, they clearly chose to release the vulnerability details and functional exploit before any distro had the ability to properly do anything about it.Either these Xint Code people have a hidden agenda or ulterior motive that we aren't aware of yet. Or they're just really bad at coordinated vulnerability disclosure. You pick.
(DIR) Post #B5p5ync850MFUI2TAG by wdormann@infosec.exchange
0 likes, 0 repeats
If you're curious about IOCs for copyfail, look in syslog for:NET: Registered PF_ALG protocol familyfor attempts to exploit copyfail on systems that use the vulnerable code as a module. For systems that have the vulnerable code compiled into the kernel, like RHEL, you'll see this line on every boot.And at least for this particular flavor of exploit, a wall-clock nearby:process 'su' launched '/bin/sh with NULL argv: empty string added`is an indication of successful exploitation.But it's worth noting that the "process launched" stuff is merely what the ITW PoC will leave behind. More clever exploitation may not be as obvious.
(DIR) Post #B5q3MlYhGemXMI87Ie by wdormann@infosec.exchange
1 likes, 0 repeats
What went wrong with this case?Theori appear to have only contacted the linux kernel devs with the vulnerability, as opposed to going the usual CVD route that includes all of the major Linux distros.Why is this a problem? Since the linux kernel became a CNA, there has been a flood of CVEs for the Linux kernel. The Linux kernel devs' arguments is that any given kernel flaw could presumably be leveraged to behave as a vulnerability, and it's not worth their time to determine "vulnerability" or "not a vulnerability". Everything gets a CVE.Now the case with copy.fail? It was indeed reported to the kernel devs. And it got a CVE. A single CVE buried in flood of all of the Linux kernel CVEs.And it appears that every distro on the planet was blindsided by this proven-exploitable vulnerability because they were not given any warning. Or even any suggestion to pick this single CVE out of the sea of Linux kernel CVEs as worth cherry picking.Much to the chagrin of the Linux devs, RHEL doesn't use up-to-date Linux kernels. They cherry pick CVEs to backport to their chosen kernel version. (e.g. the latest and greates RHEL 10.1 uses 6.12.0, which was released November 17 2024). And in this world where bad actors like Theori don't involve vendors in vulnerability coordination, and just about every Linux kernel bug gets a CVE, this workflow fails. Hard.Good times...
(DIR) Post #B5q3MlzzdAcGiwtuqW by wdormann@infosec.exchange
0 likes, 0 repeats
Unlike what the buffoons at Theori published as a "mitigation", the folks at Red Hat actually published a viable mitigation for CopyFail CVE-2026-31431.Specifically, edit your grub (or whatever you use to load your kernel) configuration to have one of the following arguments:initcall_blacklist=algif_aead_initinitcall_blacklist=af_alg_initinitcall_blacklist=crypto_authenc_esn_module_initWith such boot arguments to the Linux kernel, the affected bits won't be reachable.
(DIR) Post #B5rP1Y0KrK6BOCIxsG by wdormann@infosec.exchange
0 likes, 0 repeats
@joshbressers @Viss If only there were human beings out there who had any sort of experience with coordinating vulnerabilities... 😂
(DIR) Post #B69xCUWD3Pc73AslnM by wdormann@infosec.exchange
1 likes, 0 repeats
Remember the early days of Uber and Lyft, when rides were dirt cheap because the companies were operating at a loss in order to capture the minds/wallets of the masses?The rug pull in the AI/LLM world when the companies adjust pricing to actually make a profit is going to be spectacular. Especially when you consider the numbers of people / orgs that are addicted to or dependent on such technology.
(DIR) Post #B6Hxzz7rbFIlQnm5Bo by wdormann@infosec.exchange
1 likes, 0 repeats
Impressive!
(DIR) Post #B6NVwVBWpanjvzncAK by wdormann@infosec.exchange
0 likes, 0 repeats
Stolen from the bad site:GNU people:ls is more than enough characters.Powershell people:How about Remove-MgIdentityAuthenticationEventFlowAsOnGraphAPretributeCollectionExternalUserSelfServiceSignUpAttributeIdentityUserFlowAttributeByRef ?
(DIR) Post #B6R360ZPOJ61qEzOnA by wdormann@infosec.exchange
0 likes, 0 repeats
New from Nightmare-Eclipse, we have MiniPlasmaWorks reliably to get a SYSTEM cmd.exe prompt on Win11 (including 26H1) with May's updates. Is reportedly a failure to properly fix CVE-2020-17103. I'll note that it does not seem to work on the latest Insider Preview Canary Windows 11.
(DIR) Post #B6R360nEYu9gX7SRLE by wdormann@infosec.exchange
1 likes, 0 repeats
The Nightmare-Eclipse repo clearly credits James Forshaw with the CVE-2020-17103 vulnerability that MiniPlasma is based off of.Did Nightmare-Eclipse modify MiniPlasma to use a variant of CVE-2020-17103 that still works on modern Windows, which surely contains the fix?NO. MiniPlasma IS the poc from the GPZ write-up, but with a minor tweak to do something (LPE).Why does it work on current Windows?Well, instead of fixing CVE-2020-17103, they decided to break the PoC instead. And yeah, with Win10 Dec 2020 and Win11 RTM, the GPZ PoC doesn't work.But somewhere between Win11 RTM and 22H2 (I have neither the VM snapshots nor the patience to determine when exactly), whatever thing Microsoft did to break the CVE-2020-17103 PoC regressed. An because it wasn't a fix, then surely Microsoft had no regression test to detect that the fix was no longer present.So here we are. MiniPlasma is the GPZ PoC, but modified slightly to achieve LPE instead of creating DEMODEMO in the registry.Since Microsoft didn't bother fixing CVE-2020-17103, will CVE-2020-17103 simply be updated with the MiniPlasma recognition that it wasn't actually fixed in December 2020? Get real. This will surely get a new CVE, as CVEs are for Microsoft updates, not vulnerabilities. 😂
(DIR) Post #B6U5To1yRiQBHghocS by wdormann@infosec.exchange
0 likes, 0 repeats
Note that I've found the hold CRTL and do NOT lift your finger off it part of YellowKey to be completely unnecessary.From the beginning, I wondered why that was even part of the instructions (what does it accomplish?). And I guess the answer to that question is: Nothing?🤷♂️
(DIR) Post #B6U5ToHvUPBK5AAYU4 by wdormann@infosec.exchange
0 likes, 0 repeats
Microsoft has released CVE-2026-45585 to document YellowKey mitigations.Specifically, you prevent the FsTx Auto Recovery Utility, autofstx.exe, from automatically starting when the WinRE image launches.With this change, the Transactional NTFS replaying that deletes winpeshl.ini no longer happens. It also recommends switching from TPM-only to TPM+PIN.But wait!, you clever security-conscious person exclaims. If the WinRE partition is unencrypted, what stops an attacker from simply splatting back a vulnerable WinRE partition/image? You are right, you can indeed do this and you'll get a CMD prompt when WinRE is entered. However, the modification of WinRE will cause the trust relationship between bitlocker and WinRE to fail. And as such, while you are at your handy cmd.exe prompt, you will not get an automatically-decrypted bitlocker partition.
(DIR) Post #B6UCTZlYBLECinrRqK by wdormann@infosec.exchange
1 likes, 0 repeats
@Rairii Thanks!
(DIR) Post #B6cpnTcADH1Mubd8qm by wdormann@infosec.exchange
1 likes, 0 repeats
Apparently there's a subculture of people who pay $6000 for a DMA-using game cheat device.And when Riot games enabled IOMMU restrictions, said consumers got in an uproar that their computers were "bricked" and/or they needed to "reinstall Windows".I can't decide who is less informed:Me about the gaming world.The gaming world about how computers work. https://nitter.net/riotgames/status/2057604027941302564
(DIR) Post #B6jWtbLGKtm4xLOyOG by wdormann@infosec.exchange
1 likes, 1 repeats
Neat.An unprivileged user can crash Windows if it has a USB printer driver loaded.No CVE because it doesn't meet MSRC's bar for servicing.
(DIR) Post #B6nUxDVzRYgYwMr6jA by wdormann@infosec.exchange
1 likes, 0 repeats
Well this was an interesting view into those using AI for bug bounties. I was able to only grab about 7GB of files before it was taken offline.When even the files that seem to be input to AI appear to be generated by AI (littered with things you can't type on a keyboard), I'm curious how much a human was involved with any of this. 😂