RedSun – Microsoft Defender Elevation of Privilege

Repository contains a single C++ exploit source file (RedSun.cpp), a short README, and a license. The README describes a local privilege escalation technique abusing Microsoft Defender behavior when handling malicious files with a cloud tag: instead of only quarantining/removing, Defender may rewrite the original file back to disk, which the PoC leverages to overwrite protected system files. The exploit is a standalone Windows local exploit, not part of a common framework. RedSun.cpp uses low-level Windows and NT native APIs plus Cloud Files API headers (cfapi.h), reparse-point manipulation, and object manager enumeration. The visible code shows dynamic resolution of ntdll exports, custom NT structure definitions, helper logic for enumerating shadow volume/object directory entries, and use of DeviceIoControl with FSCTL_SET_REPARSE_POINT to establish a mount-point/reparse-point redirection. It then races on the protected target \??\C:\Windows\System32\TieringEngineService.exe using NtCreateFile with FILE_SUPERSEDE semantics until access succeeds. After the overwrite condition is achieved, the exploit copies its own executable image into %WINDIR%\System32\TieringEngineService.exe and invokes LaunchTierManagementEng(), which is intended to start the Tiering Engine component and thereby execute the attacker-controlled replacement binary with elevated privileges. Overall purpose: operational local privilege escalation on Windows via Defender/cloud-file restoration behavior and filesystem redirection/race techniques. No external network C2 or remote endpoints are present; the exploit is entirely local and file-system focused.

Repository contains a Windows local privilege escalation PoC for CVE-2026-41091 targeting Microsoft Defender/Microsoft Malware Protection Engine link-following behavior. Structure is simple: two C++ source files plus README/license/gitignore. The main exploit logic is in full_poc.cpp; basic_poc.cpp is a reduced educational demonstration of the core filesystem race/redirection algorithm. The exploit capability is SYSTEM privilege escalation from a low-privileged local context. The chain combines several Windows-native mechanisms: writing an EICAR test string to trigger Defender activity, monitoring \Device for HarddiskVolumeShadowCopy creation as a timing signal, acquiring batch oplocks on bait/cloud files, renaming directories during the race window, creating an NTFS junction to C:\Windows\System32, and then copying a payload into System32. The full PoC extends this with Cloud Files API (CfAPI) sync-root/placeholder operations and COM activation of the Storage Tiers Management service (CLSID 50d185b9-fff3-4656-92c7-e4018da4361d) to complete the SYSTEM execution chain. basic_poc.cpp demonstrates the algorithm only: VSS detection via NtOpenDirectoryObject/NtQueryDirectoryObject from ntdll.dll, batch oplock requests with FSCTL_REQUEST_BATCH_OPLOCK, junction creation, and payload copy into System32. full_poc.cpp is the operational version with CfAPI integration (cfapi.lib), cloud placeholder creation, sync-root handling, and service activation. No external network C2 or remote endpoints are present; this is a purely local Windows exploit. The README documents affected versions, build instructions, and the intended exploit chain. Overall, this is a real exploit repository rather than a detector, with hardcoded local behavior and a fixed escalation path, making maturity best classified as OPERATIONAL.

Small two-file repository containing a single C++ proof-of-concept skeleton and a descriptive README for CVE-2026-41091 ('RedSun'). The code is a local Windows privilege-escalation demonstration targeting Microsoft Defender link-following/remediation behavior. Repository structure is minimal: `CVE-2026-41091.cpp` contains all executable logic, while `README.md` provides vulnerability background, affected versions, mitigation guidance, and references. The exploit capability implemented in code is limited and clearly skeletal. It prints a banner, creates a temporary directory under the current user's temp path, writes a marker string to `malicious.cloud`, and attempts to create a junction object intended to point at `C:\Windows\System32`. It then pauses briefly to simulate a Defender remediation event. Comments explicitly state that the reparse buffer is incomplete and that cloud attributes/reparse handling are not actually implemented. As written, it does not perform a working privileged file write or trigger code execution; instead it models the attack chain conceptually. The intended attack path described by both code comments and README is: a low-privileged local user prepares a cloud-tagged file, abuses directory junctions/reparse points, and relies on Microsoft Defender running as SYSTEM to rewrite or restore the file into a protected location. That would yield arbitrary file write as SYSTEM and potentially enable overwriting a privileged binary such as `TieringEngineService.exe`, followed by execution/activation for full SYSTEM compromise. Because the repository lacks the real cloud-file manipulation, proper reparse-point construction, race logic, and execution trigger, this should be classified as a PoC skeleton rather than an operational exploit. No network communication, C2, remote callbacks, or external service interaction are present in the code. Fingerprintable artifacts are primarily local filesystem targets and references: `%TEMP%\RedSun_PoC`, `%TEMP%\RedSun_PoC\malicious.cloud`, `%TEMP%\RedSun_PoC\junction`, and `C:\Windows\System32`. Overall purpose: educational demonstration of a Defender local privilege escalation technique based on improper link resolution during remediation/rollback.