RedSun: System user access on Win 11/10 and Server with the April 2026 Update

Post by IFC_LLC » Thu, Apr 16, 2026, 1:48 PM UTC

uep wrote: post #29

nailer wrote: post #23

Earlier quoted context omitted.

> Windows XP Service Pack 2. After that thing windows XP became a legend. God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G. By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.

I agree with you on everything except the browser. I'm pretty sure I was using Firefox (or maybe Opera?) on Windows before the release of Vista. I know I was still using IE for some ActiveX web apps for a while. This was the era that I switched over to Linux full-time, but both Windows 2000 and XP were great OSes at this time. Linux was painful to adopt, but I really loved the promise of "full-control" over my comput…

Post by molticrystal » Thu, Apr 16, 2026, 2:45 PM UTC

luma wrote: post #28

trollbridge wrote: post #25

Earlier quoted context omitted.

That's how the exploit works.

I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution. The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.

Post by orbital-decay » Thu, Apr 16, 2026, 4:39 PM UTC

IFC_LLC wrote: post #20

I remember the times when Microsoft had a lot of problems 20 years ago because of Sasser and other viruses that were taking over Windows. They did not have any contenders. Yet they have stopped any software development for 9 months just to re-work their entire codebase to prevent things like direct memory execution and stuff like that. The result of that was Windows XP Service Pack 2. After that thing windows XP beca…

Post by luma » Thu, Apr 16, 2026, 4:41 PM UTC

molticrystal wrote: post #34

luma wrote: post #28

Earlier quoted context omitted.

I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution. The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.

What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem. [0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...

Post by hnlmorg » Thu, Apr 16, 2026, 5:12 PM UTC

GuestFAUniverse wrote: post #22

hnlmorg wrote: post #13

Earlier quoted context omitted.

Only if you’re running daemons as root. Which would be an idiotic move to begin with because that’s not how distros package their services. So you’d have to intentionally make this mistake.

Intentionally? Ignorance is bliss! Simply use docker in its (old) default setup, instead of podman, apptainer, docker-rootless ... and that world is yours. Added bonuses are the incredible stupid integration with ufw on Ubuntu, images with laughable uid mapping, ... How that shit got traction baffles me.