9 ms·

RedSun: System user access on Win 11/10 and Server with the April 2026 Update

195 points by airhangerf15 6mo ago

luma 6mo ago
Tried to download and Defender blocks it.
- trollbridge 6mo ago
  That's how the exploit works.
  - luma 6mo ago
    I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution. The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.
    - molticrystal 6mo ago
      What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem. [0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main/05-windows-advanced/topics/05-Evasion/04-AMSI-Bypass/example.c https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...
      - luma 6mo ago
        Detected: Program:Win32/Wacapew.C!ml With a link to: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FWacapew.C!ml&threatid=265744 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...
ranger_danger 6mo ago
> normally I would just drop the PoC code and let people figure it out Looks like that's exactly what they did though? Or maybe they just meant that they don't usually explain how it works?
- kijin 6mo ago
  Tney gave it a sexy name and set up a website about it (a github repo, at any rate), instead of just talking about it in a mailing list and getting a CVE like a proper bearded security researcher.
  - tclancy 6mo ago
    It’s getting warm above the equator, they may have shaved for the season.
deleted 6mo ago
[deleted]
egeozcan 6mo ago
I wonder why Windows Defender has the privilege to alter the system files. Read them for analysis? Sure! Reset (as in, call some windows API to have it replaced with the original), why not? But being able to write sounds like a bad idea. However, I don't know what I'm talking about so take it with a grain of salt!
- EvanAnderson 6mo ago
  AV had traditionally run as SYSTEM on Windows (and, in the past, often had kernel mode drivers too). I've always thought it was a terrible idea. It opens up exciting new attack surfaces. Kaspersky and McAfee both had privilege escalation vulnerabilities that I can recall. There have been a ton in multiple products over the years.
  - labelbabyjunior 6mo ago
    They kind of have to, though. If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again? AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.
    - EvanAnderson 6mo ago
      The OS should do the SYSTEM-level lifting and scanning processes and behavior analysis should run sandboxed as low priv processes. It would require a clearly defined API and I feel like MSFT was always reticent to commit, leaving AV manufacturers to create hacky nightmares.
      - labelbabyjunior 6mo ago
        Well the OS should do nothing—remember MS was taken to court over that—but better privsep on the part of the AV, sure. Technically, Defender can be replaced with 3rd party AV.
    - 6mo ago
labelbabyjunior 6mo ago
A local privilege escalation to root via an exploitable service? Doesn't Linux have one of these CVEs...each week?
- hsbauauvhabzb 6mo ago
  Probably, but is that service deployed as part of the base operating system or a third party package? Can you remove the service if you deem the crazy service behaviour is unnecessary or too risky for your usecase?
- hnlmorg 6mo ago
  Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.
  - GuestFAUniverse 6mo ago
    Intentionally? Ignorance is bliss! Simply use docker in its (old) default setup, instead of podman, apptainer, docker-rootless ... and that world is yours. Added bonuses are the incredible stupid integration with ufw on Ubuntu, images with laughable uid mapping, ... How that shit got traction baffles me.
    - hnlmorg 6mo ago
      That’s just the docker daemon. The actual docker services would (or at least should) still be running as its own user/group just like they would if you were running them on the host. And that’s exactly how any reputable image would be built.
- BodyCulture 6mo ago
  No.
- IshKebab 6mo ago
  Not quite every week, but yeah it has a lot. And if the target uses sudo at all you don't even need an exploit! But nobody mentioned Linux. There's no need for whataboutism. They both shouldn't have these vulnerabilities.
hathym 6mo ago
cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib
- technion 6mo ago
  Seriously this is my bugbear with code for windows: how did you figure that invocation out? Anything for Linux you just type "make". If the author skipped a makefile, theres rarely much to it. But when someone has a cpp file for Windows it looks like this.
  - delta_p_delta_x 6mo ago
    This is a misrepresentation. This command-line is the compiler invocation, and is not the equivalent to 'make' on Windows. The actual equivalent on Linux, in the same order of the arguments to cl.exe would be: cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib g++ -std=c++17 -Wall -O3 -DUNICODE -D_UNICODE -Wno-builtin-macro-redefined -o RedSun.exe RedSun.cpp -ladvapi -lole32 -luser32 I see no difference. One uses slash-demarcated arguments, the other uses hyphens. The g++ invocation is missing the flag for the exception handling model[1]. Otherwise, it is a matter of what you are used to. In fact, if you have MinGW, this exact command-line invocation will probably work correctly. When you install the VS build tools you get nmake which processes most Makefiles just fine. Or you get a solution file, in which case you just open the solution in VS and press F5. Or if you are hung up about doing it in the command-line, it would be msbuild.exe foo.sln Or with CMake, which has a cross-platform command-line, cmake --preset somepreset Linux people who don't know Windows and complain that 'it looks like this' is my bugbear, when they can spend hours fixing a dumb in-tree driver with printf debugging that works plug-and-play on Windows. [1]: https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exception-handling-model?view=msvc-170 https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exc...
IFC_LLC 6mo ago
I remember the times when Microsoft had a lot of problems 20 years ago because of Sasser and other viruses that were taking over Windows. They did not have any contenders. Yet they have stopped any software development for 9 months just to re-work their entire codebase to prevent things like direct memory execution and stuff like that. The result of that was Windows XP Service Pack 2. After that thing windows XP became a legend. Now, when Linux is slowly creeping on one side, and Mac NEO on another they keep releasing this AI-slop. By the looks of it they make most of their money from the cloud and other software things nowadays. And Windows has become a sidekick in their processes.
- nailer 6mo ago
  > Windows XP Service Pack 2. After that thing windows XP became a legend. God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G. By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.
  - uep 6mo ago
    I agree with you on everything except the browser. I'm pretty sure I was using Firefox (or maybe Opera?) on Windows before the release of Vista. I know I was still using IE for some ActiveX web apps for a while. This was the era that I switched over to Linux full-time, but both Windows 2000 and XP were great OSes at this time. Linux was painful to adopt, but I really loved the promise of "full-control" over my computer. My peeve today is how bad modern chat programs feel compared to the old instant messengers. The modern programs all feel slow and clunky in comparison. I felt that all of the messengers I used (MSN, AIM, ICQ) were more responsive than their modern day equivalents.
    - IFC_LLC 6mo ago
      Boy oh boy, have we forgotten the Maxthon? https://en.wikipedia.org/wiki/Maxthon https://en.wikipedia.org/wiki/Maxthon I remember the times when IE passed ACID test? Do we remember the ACID? http://acid2.acidtests.org/#top http://acid2.acidtests.org/#top Ah, what the times were those. Firefox was just gaining traction. And I agree. Slack is sitting there, consuming over gig of memory on my computer, and Miranda NG was able to do the same functionality with cool skins and just 30 megs of ram. Skins... Skins... We've lost even those...
lexicality 6mo ago
helpfully the user provides a second tool which automatically turns off Windows Defender so you can't be affected by this: https://github.com/Nightmare-Eclipse/UnDefend https://github.com/Nightmare-Eclipse/UnDefend
- layer8 6mo ago
  > It runs in two modes, passive and aggressive Lol
  - hulitu 6mo ago
    Unlike Windows Defender which is passive aggressive.
Implement7347 6mo ago
I'd love to think that this person is a rogue AI, (better than Claude mythos?) Dropping two zero days in one month is pretty interesting. Nice work.
Dwedit 6mo ago
Any way to disable the entire cloud tag system?

195 points by airhangerf15 6mo ago

luma 6mo ago

Tried to download and Defender blocks it.

trollbridge 6mo ago
That's how the exploit works.
- luma 6mo ago
  I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution. The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.
  - molticrystal 6mo ago
    What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem. [0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main/05-windows-advanced/topics/05-Evasion/04-AMSI-Bypass/example.c https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...
    - luma 6mo ago
      Detected: Program:Win32/Wacapew.C!ml With a link to: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FWacapew.C!ml&threatid=265744 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...

ranger_danger 6mo ago

> normally I would just drop the PoC code and let people figure it out Looks like that's exactly what they did though? Or maybe they just meant that they don't usually explain how it works?

kijin 6mo ago
Tney gave it a sexy name and set up a website about it (a github repo, at any rate), instead of just talking about it in a mailing list and getting a CVE like a proper bearded security researcher.
- tclancy 6mo ago
  It’s getting warm above the equator, they may have shaved for the season.

deleted 6mo ago

[deleted]

egeozcan 6mo ago

I wonder why Windows Defender has the privilege to alter the system files. Read them for analysis? Sure! Reset (as in, call some windows API to have it replaced with the original), why not? But being able to write sounds like a bad idea. However, I don't know what I'm talking about so take it with a grain of salt!

EvanAnderson 6mo ago
AV had traditionally run as SYSTEM on Windows (and, in the past, often had kernel mode drivers too). I've always thought it was a terrible idea. It opens up exciting new attack surfaces. Kaspersky and McAfee both had privilege escalation vulnerabilities that I can recall. There have been a ton in multiple products over the years.
- labelbabyjunior 6mo ago
  They kind of have to, though. If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again? AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.
  - EvanAnderson 6mo ago
    The OS should do the SYSTEM-level lifting and scanning processes and behavior analysis should run sandboxed as low priv processes. It would require a clearly defined API and I feel like MSFT was always reticent to commit, leaving AV manufacturers to create hacky nightmares.
    - labelbabyjunior 6mo ago
      Well the OS should do nothing—remember MS was taken to court over that—but better privsep on the part of the AV, sure. Technically, Defender can be replaced with 3rd party AV.
  - 6mo ago

labelbabyjunior 6mo ago

A local privilege escalation to root via an exploitable service? Doesn't Linux have one of these CVEs...each week?

hsbauauvhabzb 6mo ago
Probably, but is that service deployed as part of the base operating system or a third party package? Can you remove the service if you deem the crazy service behaviour is unnecessary or too risky for your usecase?
hnlmorg 6mo ago
Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.
- GuestFAUniverse 6mo ago
  Intentionally? Ignorance is bliss! Simply use docker in its (old) default setup, instead of podman, apptainer, docker-rootless ... and that world is yours. Added bonuses are the incredible stupid integration with ufw on Ubuntu, images with laughable uid mapping, ... How that shit got traction baffles me.
  - hnlmorg 6mo ago
    That’s just the docker daemon. The actual docker services would (or at least should) still be running as its own user/group just like they would if you were running them on the host. And that’s exactly how any reputable image would be built.
BodyCulture 6mo ago
No.
IshKebab 6mo ago
Not quite every week, but yeah it has a lot. And if the target uses sudo at all you don't even need an exploit! But nobody mentioned Linux. There's no need for whataboutism. They both shouldn't have these vulnerabilities.

hathym 6mo ago

cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib

technion 6mo ago
Seriously this is my bugbear with code for windows: how did you figure that invocation out? Anything for Linux you just type "make". If the author skipped a makefile, theres rarely much to it. But when someone has a cpp file for Windows it looks like this.
- delta_p_delta_x 6mo ago
  This is a misrepresentation. This command-line is the compiler invocation, and is not the equivalent to 'make' on Windows. The actual equivalent on Linux, in the same order of the arguments to cl.exe would be: cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib g++ -std=c++17 -Wall -O3 -DUNICODE -D_UNICODE -Wno-builtin-macro-redefined -o RedSun.exe RedSun.cpp -ladvapi -lole32 -luser32 I see no difference. One uses slash-demarcated arguments, the other uses hyphens. The g++ invocation is missing the flag for the exception handling model[1]. Otherwise, it is a matter of what you are used to. In fact, if you have MinGW, this exact command-line invocation will probably work correctly. When you install the VS build tools you get nmake which processes most Makefiles just fine. Or you get a solution file, in which case you just open the solution in VS and press F5. Or if you are hung up about doing it in the command-line, it would be msbuild.exe foo.sln Or with CMake, which has a cross-platform command-line, cmake --preset somepreset Linux people who don't know Windows and complain that 'it looks like this' is my bugbear, when they can spend hours fixing a dumb in-tree driver with printf debugging that works plug-and-play on Windows. [1]: https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exception-handling-model?view=msvc-170 https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exc...

IFC_LLC 6mo ago

I remember the times when Microsoft had a lot of problems 20 years ago because of Sasser and other viruses that were taking over Windows. They did not have any contenders. Yet they have stopped any software development for 9 months just to re-work their entire codebase to prevent things like direct memory execution and stuff like that. The result of that was Windows XP Service Pack 2. After that thing windows XP became a legend. Now, when Linux is slowly creeping on one side, and Mac NEO on another they keep releasing this AI-slop. By the looks of it they make most of their money from the cloud and other software things nowadays. And Windows has become a sidekick in their processes.

nailer 6mo ago
> Windows XP Service Pack 2. After that thing windows XP became a legend. God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G. By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.
- uep 6mo ago
  I agree with you on everything except the browser. I'm pretty sure I was using Firefox (or maybe Opera?) on Windows before the release of Vista. I know I was still using IE for some ActiveX web apps for a while. This was the era that I switched over to Linux full-time, but both Windows 2000 and XP were great OSes at this time. Linux was painful to adopt, but I really loved the promise of "full-control" over my computer. My peeve today is how bad modern chat programs feel compared to the old instant messengers. The modern programs all feel slow and clunky in comparison. I felt that all of the messengers I used (MSN, AIM, ICQ) were more responsive than their modern day equivalents.
  - IFC_LLC 6mo ago
    Boy oh boy, have we forgotten the Maxthon? https://en.wikipedia.org/wiki/Maxthon https://en.wikipedia.org/wiki/Maxthon I remember the times when IE passed ACID test? Do we remember the ACID? http://acid2.acidtests.org/#top http://acid2.acidtests.org/#top Ah, what the times were those. Firefox was just gaining traction. And I agree. Slack is sitting there, consuming over gig of memory on my computer, and Miranda NG was able to do the same functionality with cool skins and just 30 megs of ram. Skins... Skins... We've lost even those...

lexicality 6mo ago

helpfully the user provides a second tool which automatically turns off Windows Defender so you can't be affected by this: https://github.com/Nightmare-Eclipse/UnDefend https://github.com/Nightmare-Eclipse/UnDefend

layer8 6mo ago
> It runs in two modes, passive and aggressive Lol
- hulitu 6mo ago
  Unlike Windows Defender which is passive aggressive.

Implement7347 6mo ago

I'd love to think that this person is a rogue AI, (better than Claude mythos?) Dropping two zero days in one month is pretty interesting. Nice work.

Dwedit 6mo ago

Any way to disable the entire cloud tag system?