Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RedSun: System user access on Win 11/10 and Server with the April 2026 Update

github.com

Post reply on HN
Print view View original

51–60 of 67 posts

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#51

Post by hnlmorg »

IshKebab wrote: post #42
hnlmorg wrote: post #41

Earlier quoted context omitted.

> And if the target uses sudo at all you don't even need an exploit! Why would a target executable use sudo? There are proper mechanisms for automated elevation of permissions and sudo isn’t it. sudo is designed for user interactivity. And by default prompts for a password. However some people get lazy and disable the password entry requirement.

A target user . If you get local code execution on the account of a user that uses sudo you can trivially got root. Doesn't matter if they disabled the password authentication or not.

Of course it matters if they disabled password authentication. If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Which is waaay beyond any effort the average attacker is willing to invest. Because At that point, root access isn’t really worth the effort.

An attacker will probably just use the host for sending spam emails, bot / DDoS traffic or look for other daemons they can jump to which weren’t web accessible (eg a database).

And furthermore, if you’ve got a RCE in a daemon then that code is the running as the daemons’ user. Which shouldn’t be in the sudoers file (eg wheel group) to begin with.

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#52

Post by delta_p_delta_x »

technion wrote: post #48
hathym wrote: post #16

cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib

Seriously this is my bugbear with code for windows: how did you figure that invocation out? Anything for Linux you just type "make". If the author skipped a makefile, theres rarely much to it. But when someone has a cpp file for Windows it looks like this.

This is a misrepresentation. This command-line is the compiler invocation, and is not the equivalent to 'make' on Windows. The actual equivalent on Linux, in the same order of the arguments to cl.exe would be:

  cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib

  g++ -std=c++17 -Wall -O3 -DUNICODE -D_UNICODE -Wno-builtin-macro-redefined -o RedSun.exe RedSun.cpp -ladvapi -lole32 -luser32
I see no difference. One uses slash-demarcated arguments, the other uses hyphens. The g++ invocation is missing the flag for the exception handling model[1]. Otherwise, it is a matter of what you are used to. In fact, if you have MinGW, this exact command-line invocation will probably work correctly.

When you install the VS build tools you get nmake which processes most Makefiles just fine. Or you get a solution file, in which case you just open the solution in VS and press F5. Or if you are hung up about doing it in the command-line, it would be

  msbuild.exe foo.sln
Or with CMake, which has a cross-platform command-line,

  cmake --preset somepreset
Linux people who don't know Windows and complain that 'it looks like this' is my bugbear, when they can spend hours fixing a dumb in-tree driver with printf debugging that works plug-and-play on Windows.

[1]: https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exc...

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#53

Post by IshKebab »

hnlmorg wrote: post #51
IshKebab wrote: post #42

Earlier quoted context omitted.

A target user . If you get local code execution on the account of a user that uses sudo you can trivially got root. Doesn't matter if they disabled the password authentication or not.

Of course it matters if they disabled password authentication. If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Which is waaay beyond any effort the average attacker is willing to invest. Because At that point, root access isn’t really worth the effort. An attacker will probably just use the host for sending spam emails, bot / DDoS traffic…

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password.

Nope! Just alias sudo to something that logs the password.

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#54

Post by gamer191 »

IshKebab wrote: post #53
hnlmorg wrote: post #51

Earlier quoted context omitted.

Of course it matters if they disabled password authentication. If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Which is waaay beyond any effort the average attacker is willing to invest. Because At that point, root access isn’t really worth the effort. An attacker will probably just use the host for sending spam emails, bot / DDoS traffic…

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Nope! Just alias sudo to something that logs the password.

Interesting. If that’s possible (I haven’t tested it, but I’m sure it is) then you wouldn’t even need to log the password. You could just alias sudo to a bash script that runs your malicious payload using the real sudo. Then the user would run the command, be prompted for their password by the real sudo, and be none the wiser that a malicious script has just been executed

For what it’s worth, Windows’ security model says it’s not an exploit that programs can grant themselves admin rights if the user is an admin (https://github.com/hfiref0x/UACME). But afaik Linux doesn’t have that model so it is a bit of an issue that this is possible

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#55

Post by hnlmorg »

IshKebab wrote: post #53
hnlmorg wrote: post #51

Earlier quoted context omitted.

Of course it matters if they disabled password authentication. If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Which is waaay beyond any effort the average attacker is willing to invest. Because At that point, root access isn’t really worth the effort. An attacker will probably just use the host for sending spam emails, bot / DDoS traffic…

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Nope! Just alias sudo to something that logs the password.

How are you going to do that without write access to the users home directory?

Like I said before, your RCE exploit will be running as the user and group of the service you exploited. For example www:www

So you’re not going to be able to write into Joe Bloggs .bashrc file unless Joe was stupid enough to enable write permission to “other”. Which, once again, requires the user to purposely modify the system into being less secure than its default configuration

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#56

Post by hnlmorg »

gamer191 wrote: post #54
IshKebab wrote: post #53

Earlier quoted context omitted.

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Nope! Just alias sudo to something that logs the password.

Interesting. If that’s possible (I haven’t tested it, but I’m sure it is) then you wouldn’t even need to log the password. You could just alias sudo to a bash script that runs your malicious payload using the real sudo. Then the user would run the command, be prompted for their password by the real sudo, and be none the wiser that a malicious script has just been executed For what it’s worth, Windows’ security model…

> Interesting. If that’s possible

It’s not possible. At least not unless those users have already borked their own system.

The previous poster was clutching at straws.

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#57

Post by IshKebab »

hnlmorg wrote: post #56
gamer191 wrote: post #54

Earlier quoted context omitted.

Interesting. If that’s possible (I haven’t tested it, but I’m sure it is) then you wouldn’t even need to log the password. You could just alias sudo to a bash script that runs your malicious payload using the real sudo. Then the user would run the command, be prompted for their password by the real sudo, and be none the wiser that a malicious script has just been executed For what it’s worth, Windows’ security model…

> Interesting. If that’s possible It’s not possible. At least not unless those users have already borked their own system. The previous poster was clutching at straws.

Of course it's possible. I've tried it. It works. It's just standard Unix features. What makes you think it isn't possible?

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#58

Post by IshKebab »

hnlmorg wrote: post #55
IshKebab wrote: post #53

Earlier quoted context omitted.

> If you require password authentication when running sudo then an attacker has to find a RCE exploit and then crack a password. Nope! Just alias sudo to something that logs the password.

How are you going to do that without write access to the users home directory? Like I said before, your RCE exploit will be running as the user and group of the service you exploited. For example www:www So you’re not going to be able to write into Joe Bloggs .bashrc file unless Joe was stupid enough to enable write permission to “other”. Which, once again, requires the user to purposely modify the system into being…

> your RCE exploit will be running as the user and group of the service you exploited. For example www:www

Only if the exploit is through a web server or similar. If it's through the user's web browser, email client, video player, etc. etc. then you'll have write access to their home directory.

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#59

Post by hnlmorg »

IshKebab wrote: post #57
hnlmorg wrote: post #56

Earlier quoted context omitted.

> Interesting. If that’s possible It’s not possible. At least not unless those users have already borked their own system. The previous poster was clutching at straws.

Of course it's possible. I've tried it. It works. It's just standard Unix features. What makes you think it isn't possible?

For the reasons I’ve already stated: daemons don’t run with permissions to write into users directories.

You’ve shifted goal posts to now talk about desktop applications when the topic was originally about daemons

Re: RedSun: System user access on Win 11/10 and Server with the April 2026 Update

#60

Post by hnlmorg »

IshKebab wrote: post #58
hnlmorg wrote: post #55

Earlier quoted context omitted.

How are you going to do that without write access to the users home directory? Like I said before, your RCE exploit will be running as the user and group of the service you exploited. For example www:www So you’re not going to be able to write into Joe Bloggs .bashrc file unless Joe was stupid enough to enable write permission to “other”. Which, once again, requires the user to purposely modify the system into being…

> your RCE exploit will be running as the user and group of the service you exploited. For example www:www Only if the exploit is through a web server or similar. If it's through the user's web browser, email client, video player, etc. etc. then you'll have write access to their home directory.

But thats not a daemon then. Thats a completely different type of exploit from the ones we were originally talking about.

Yes, if a desktop application has a bug then it can do damage. But at that point, who cares about sudo? The exploit already has access to your ssh keys, browser cookies and history (so can access banking and shopping sites), crypto-currency wallets and so on and so forth.

What an exploit has access to here is so much worse than getting root access on a desktop OS.

Post reply on HN