May 11, 2026: The Red Sun still prevails.

[jhr77@mastodon.social]

@christopherkunz @wdormann @GossiTheDog same same here. It's getting worse when asking more questions. But it was possible to replace with the original version. Hopefully the system is clean now. Maybe making a scan with the defender...

[wdormann@infosec.exchange]

@jhr77 @christopherkunz @GossiTheDog
The exploit made no claims about being temporary.

[wdormann@infosec.exchange]

@christopherkunz @jhr77 @GossiTheDog
No, Windows does not do periodic filesystem checks to ensure that files have not been corrupted.

It's up to you to run sfc /scannow and associated tools if you think your Windows installation is corrupt.

[wdormann@infosec.exchange]

@jhr77 @christopherkunz @GossiTheDog
Always revert your VM to a clean state before (and after) testing an exploit.

[christopherkunz@chaos.social]

@wdormann @jhr77 @GossiTheDog OK, I don't get this. I did the following:
1. DISM /Online /Cleanup-Image /RestoreHealth
2. sfc /scannow
3. Checked that the TieringEngineService.exe has two signatures (like in your screenshot) and got replaced properly (as per the log).
4. Rebooted and re-checked if the .exe is still properly signed.
5. Re-Ran RedSun.exe
6. Popped a shell again.
I'm going to boot a clean Win11 VM again.

[christopherkunz@chaos.social]

@wdormann @jhr77 @GossiTheDog Meanwhile, slightly elsewhere: https://github.com/Nightmare-Eclipse/GreenPlasma
Looking forward to seeing the writeup to this.
https://github.com/Nightmare-Eclipse/YellowKey

[jhr77@mastodon.social]

@christopherkunz @wdormann @GossiTheDog Has this person also other hobbies than exploiting Windows?

[christopherkunz@chaos.social]

@jhr77 @wdormann @GossiTheDog Well, they're certainly pissed at MS: "Microsoft has chosen to make this worst instead of resolving the situation like adults, they pulled every childish game possible. My patience is running out you're making everyone else paying for it."

[wdormann@infosec.exchange]

@christopherkunz @jhr77 @GossiTheDog
GreenPlasma prompts for admin creds, so to call it a privilege escalation is a stretch.

As for YellowKey, the writeup is a bit too hand-wavy for me to follow, so I'll leave the repro to somebody else to try.

[buherator@infosec.place]

@wdormann @jhr77 @christopherkunz I don't see a Defender entry in today's update that also points to this being a signature based mitigation

[wdormann@infosec.exchange]

@buherator @christopherkunz @jhr77
I can't imagine why they'd wait for Patch Tuesday if they already have the path to fix it automatically at any time they want. ‍️

[buherator@infosec.place]

@wdormann @christopherkunz @jhr77 Vuln mgmt is hard, e.g. how you track patch coverage vs. signature update status? Not that pushing a sig was a bad idea, I'd just expect a KB for this too.

[wdormann@infosec.exchange]

@buherator @christopherkunz @jhr77
Right. There is no official statement that the vulnerability was actually fixed.

I personally believe that it was fixed, as I can no longer reproduce the exploit with updated definitions.

I suspect that others in this thread do not agree with me.

Would be nice to have a definitive answer.

[wdormann@infosec.exchange]

@buherator @christopherkunz @jhr77
Related: In Microsoft's world, CVEs are identifiers for software updates released on Patch Tuesday (or OOB through the same channel), not vulnerabilities. They used to have proprietary identifiers for their software updates, like MS08-067, but when they switched to using CVEs, they didn't switch what the identifiers are for.

As such, I could imagine why they didn't think a CVE was necessary for the vulnerability that allowed the RedSun exploit to work.

[jhr77@mastodon.social]

@christopherkunz @wdormann @GossiTheDog What the h... is that yellowkey? I am a little bit afraid to try it. It sounds that it should be better prepared not on a windows system and tested on a completely separate pc.

[wdormann@infosec.exchange]

@jhr77 @christopherkunz @GossiTheDog
I've not been able to reproduce YellowKey in a VMware Workstation VM.

So either VMware is interfering with the hold CRTL and do NOT lift your finger off it apparently required part of the exploit, or it simply doesn't work.

Even if it did work, I suspect that it'd perhaps only work on systems that don't both with PIN-on-boot protection. Which is sort of known to be not terribly secure.