Everything you need to know about nightmare eclipse redsun the red sun.
[ad_1]The Red Sun vulnerability repository
Now, normally I would just drop the PoC code and let people figure it out. But I can’t for this one, it’s way too funny. When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that’s supposed to protect decides that it is a good idea to just rewrite the file it found again to it’s original location. The PoC abuses this behaviour to overwrite system files and gain administrative privileges.
I think antimalware products are supposed to remove malicious files not be sure they are there but that’s just me.
[ad_2]
Source link
More on nightmare eclipse redsun the red sun
Stay tuned for updates on nightmare eclipse redsun the red sun as the story develops. Related: Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed.
Frequently Asked Questions
The Red Sun vulnerability repository contains a proof-of-concept showing that Windows Defender, upon finding a malicious file with a cloud tag, rewrites the file to its original location.
The PoC abuses Windows Defender's behavior of rewriting a found file to its original location, which can be used to overwrite system files and gain administrative privileges.
The author finds it funny that an antivirus meant to protect a system instead ensures a malicious file stays in place, noting that antimalware products are supposed to remove malicious files.
