BlueHammer Windows 11 Zero day exploit on patched systems- using Defender vulnerability


PerpetualCycle

PerpetualCycle

Syzygy
Pro User
VIP
Local time
11:14 PM
Posts
13,044
OS
Windows 11 Pro
It requires local access that a hacker can gain through phishing or other means, but after that it can gain SYSTEM privileges through a software architecture vulnerability in how Defender works. It can't be patched or detected by regular means since it doesn't rely on a software flaw. It's code was made been available github about a week ago.

www.bleepingcomputer.com

Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit

Exploit code has been released for an unpatched Windows privilege escalation flaw reported privately to Microsoft, allowing attackers to gain SYSTEM or elevated administrator permissions.
www.bleepingcomputer.com www.bleepingcomputer.com

www.cyderes.com

BlueHammer: Inside the Windows Zero-Day

Howler Cell outlines the BlueHammer exploit, a Windows zero-day leveraging Defender's update process to escalate privileges, remaining unpatched.
www.cyderes.com www.cyderes.com
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProIntel Core i9 14900K 5800/4500 P/E96GB (2x48) G.skill Ripjaws 6800Asus ROG Strix 4070 Ti OC
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY Photoshop/Audio/Game/tinker
    CPU
    Intel Core i9 14900K 5800/4500 P/E
    Motherboard
    Asus ROG Maximus Z790 Dark Hero
    Memory
    96GB (2x48) G.skill Ripjaws 6800
    Graphics Card(s)
    Asus ROG Strix 4070 Ti OC
    Sound Card
    B&W 606 S3 speakers; Audiolabs 7000a integrated amp; RSL 10S Mk2 sub
    Monitor(s) Displays
    Eizo CG2730 ColorEdge, ViewSonic VP2768
    Screen Resolution
    2560 x 1440 x 2
    Hard Drives
    nvme: 4TB WDC SN850X, 1TB SN850, 2TB SK-Hynix P41
    Spinners: Sabrent USB-C DS-SC5B 5-bay docking station, 6TB WDC Black, 6TB Ironwolf Pro 2x 2TB WDC Black
    PSU
    850W Seasonic Vertex PX-850
    Case
    FD North XL Mesh, Black Walnut
    Cooling
    EK Nucleus black 360 AIO w/Phanteks T30 fans; 2 Noctua NF-A14 Chromax ; T30 for memory
    Keyboard
    Keychron Q3 Max TKL w/GMK Redsuns Red Samuri keycaps
    Mouse
    Logitech G305 wireless gaming
    Internet Speed
    575 Mb/s down | 25 Mb/s up
    Browser
    Firefox
    Antivirus
    Defender, Macrium Reflect X
    Other Info
    Phangkey Amaterasu V2 Desk Mat

  • At a glance

    Apple M1
    Computer type
    Laptop
    Manufacturer/Model
    💻 Apple 13" Macbook Pro 2020 (m1)
    CPU
    Apple M1
    Screen Resolution
    2560x1600
    Browser
    Firefox
Where are you getting that it can't be patched?
 

My Computer My Computer

At a glance

Windows 11 Enterprise 25H2
OS
Windows 11 Enterprise 25H2
pseymour said:
Where are you getting that it can't be patched?
Click to expand...

I did not say that. I said it cannot be patched by regular means as it is the way that Defender and the system shadow copy interact when running a scan. Not just a code patch but also a key part of the way that defender works.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProIntel Core i9 14900K 5800/4500 P/E96GB (2x48) G.skill Ripjaws 6800Asus ROG Strix 4070 Ti OC
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY Photoshop/Audio/Game/tinker
    CPU
    Intel Core i9 14900K 5800/4500 P/E
    Motherboard
    Asus ROG Maximus Z790 Dark Hero
    Memory
    96GB (2x48) G.skill Ripjaws 6800
    Graphics Card(s)
    Asus ROG Strix 4070 Ti OC
    Sound Card
    B&W 606 S3 speakers; Audiolabs 7000a integrated amp; RSL 10S Mk2 sub
    Monitor(s) Displays
    Eizo CG2730 ColorEdge, ViewSonic VP2768
    Screen Resolution
    2560 x 1440 x 2
    Hard Drives
    nvme: 4TB WDC SN850X, 1TB SN850, 2TB SK-Hynix P41
    Spinners: Sabrent USB-C DS-SC5B 5-bay docking station, 6TB WDC Black, 6TB Ironwolf Pro 2x 2TB WDC Black
    PSU
    850W Seasonic Vertex PX-850
    Case
    FD North XL Mesh, Black Walnut
    Cooling
    EK Nucleus black 360 AIO w/Phanteks T30 fans; 2 Noctua NF-A14 Chromax ; T30 for memory
    Keyboard
    Keychron Q3 Max TKL w/GMK Redsuns Red Samuri keycaps
    Mouse
    Logitech G305 wireless gaming
    Internet Speed
    575 Mb/s down | 25 Mb/s up
    Browser
    Firefox
    Antivirus
    Defender, Macrium Reflect X
    Other Info
    Phangkey Amaterasu V2 Desk Mat

  • At a glance

    Apple M1
    Computer type
    Laptop
    Manufacturer/Model
    💻 Apple 13" Macbook Pro 2020 (m1)
    CPU
    Apple M1
    Screen Resolution
    2560x1600
    Browser
    Firefox
PerpetualCycle said:
I did not say that. I said it cannot be patched by regular means as it is the way that Defender and the system shadow copy interact when running a scan. Not just a code patch but also a key part of the way that defender works.
Click to expand...
Yeah I skipped over the "by regular means" because it's one of those phrases that sounds like it means something but doesn't.
 

My Computer My Computer

At a glance

Windows 11 Enterprise 25H2
OS
Windows 11 Enterprise 25H2
pseymour said:
Yeah I skipped over the "by regular means" because it's one of those phrases that sounds like it means something but doesn't.
Click to expand...
...OK 🤷‍♂️
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProIntel Core i9 14900K 5800/4500 P/E96GB (2x48) G.skill Ripjaws 6800Asus ROG Strix 4070 Ti OC
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY Photoshop/Audio/Game/tinker
    CPU
    Intel Core i9 14900K 5800/4500 P/E
    Motherboard
    Asus ROG Maximus Z790 Dark Hero
    Memory
    96GB (2x48) G.skill Ripjaws 6800
    Graphics Card(s)
    Asus ROG Strix 4070 Ti OC
    Sound Card
    B&W 606 S3 speakers; Audiolabs 7000a integrated amp; RSL 10S Mk2 sub
    Monitor(s) Displays
    Eizo CG2730 ColorEdge, ViewSonic VP2768
    Screen Resolution
    2560 x 1440 x 2
    Hard Drives
    nvme: 4TB WDC SN850X, 1TB SN850, 2TB SK-Hynix P41
    Spinners: Sabrent USB-C DS-SC5B 5-bay docking station, 6TB WDC Black, 6TB Ironwolf Pro 2x 2TB WDC Black
    PSU
    850W Seasonic Vertex PX-850
    Case
    FD North XL Mesh, Black Walnut
    Cooling
    EK Nucleus black 360 AIO w/Phanteks T30 fans; 2 Noctua NF-A14 Chromax ; T30 for memory
    Keyboard
    Keychron Q3 Max TKL w/GMK Redsuns Red Samuri keycaps
    Mouse
    Logitech G305 wireless gaming
    Internet Speed
    575 Mb/s down | 25 Mb/s up
    Browser
    Firefox
    Antivirus
    Defender, Macrium Reflect X
    Other Info
    Phangkey Amaterasu V2 Desk Mat

  • At a glance

    Apple M1
    Computer type
    Laptop
    Manufacturer/Model
    💻 Apple 13" Macbook Pro 2020 (m1)
    CPU
    Apple M1
    Screen Resolution
    2560x1600
    Browser
    Firefox
Addressed in Antimalware Platform update 4.18.26030.3011 (April 13).
 

My Computer My Computer

At a glance

Windows 11 Enterprise 25H2
OS
Windows 11 Enterprise 25H2
You must log in or register to reply here.

Similar threads

  • Article Article
Microsoft evolving Windows 11 vulnerability management to meet the speed of AI-powered discovery
Replies
2
Views
556
BruceR
B
  • Article Article
Update your Chrome to fix new actively exploited zero-day vulnerability
Replies
2
Views
3K
antspants
antspants

Latest Support Threads

Latest Tutorials

Back
Top Bottom