2026-04-07 19:52 UTC
@wdormann oh I see, it passes back a handle. I assumed Defender did something to the file, then the unprivileged process opened the file. And yeah if it passes back a read-only handle then the code can parse out the SAM's contents as everything else needed to decrypt the hashes is accessible without any privileges (bizarre IMO).
No doubt it'd be relatively easy to narrow this down to something simpler as a PoC, perhaps that didn't help their case with MSRC who as you point out have become somewhat lazy in their triage process.
Replies (1)
-
@wdormann@infosec.exchange 2026-04-07 19:59
@tiraniddo My last MSRC submission described the vulnerability in ONE SENTENCE. MSRC said that they would not be able to proceed until I provided a video of the exploit in action. After refusing, they escalated my case after 3 days. I'm not convinced that PoC over-complexity is the problem here. Heck, the fact that they provided a PoC at all should be actionable, if they cared.