Notices by Will Dormann (wdormann@infosec.exchange)

@patrickcmiller
I'm not sure I'd call "paste this PowerShell command into the Windows run dialog" "evolved". 😂

@patrickcmiller
Fluid Karma, eh?

In today's episode of Will doesn't understand why some films get universal acclaim: Project Hail Mary.

Starts out Sci Fi, but somehow morphs into a buddy comedy (with an alien) for kids?

Also, to go through pains to clearly show how the alien uses echolocation for vision, and then later on we're expected to completely forget that and just believe that it's watching computer screens and projections. How does that even happen? I get it that 3 hours is a long film, but shouldn't the filmmaker remember what they just did?

To each their own, I suppose.

@GossiTheDog
I mean, if I tell Cursor to run git, then it'll run the one in the repo. Which I guess is bad.

But that's significantly more user interaction required than the A developer opens a repository in Cursor on Windows requirement that Mindgard says. 🤷♂️

Somewhat interesting that Cursor recognized the presence of a fake Windows Calculator git.exe, but only after executing it. 😂

@GossiTheDog
I see it check for git.exe, but I see no evidence of it attempting to run it. 🤷♂️

@GossiTheDog
OK, I guess my mistake was not WAITING THIRTY MINUTES. 🤦♂️
https://infosec.exchange/@wdormann/116930022612132890

@GossiTheDog
Will only automatically apply with October's updates.

The Opt-in remediation section has no indicator that it won't work until then.

So NightmareEclipse has released a new tool called LegacyHive

Either I don't know what it's supposed to do, or it doesn't work.

While the tool is running, there is a new pair of 1003 registry keys loaded into HKEY_USERS. But it's not possible to view its contents. 🤷♂️

I just realized that I'm personally "credited" in April's Microsoft Patch Tuesday with a CVE-less "Defense-in-depth" update.

The vulnerability?
CAB files downloaded from the internet do not write the MotW for files extracted from them.

I reported this to MSRC, and after refusing to generate a screen recording of the exploit (I mean, really?!), they finally acknowledged the problem. However, they went radio silent after that.

Mark of the Web (MotW) evasions have gotten CVEs in the past. If we look in the last 2 years we have: CVE-2024-38213, CVE-2024-38217, CVE-2024-43487, CVE-2025-24061, CVE-2025-27472, CVE-2025-47160, CVE-2025-49740, CVE-2026-20824, CVE-2026-32225, CVE-2026-45595

So, why does "Windows doesn't write MotW for extracted CAB file contents" get a CVE? Well, Microsoft is a CNA. So for the most part they can invent any rules that they'd like to play by. It could be as simple as "We're not particularly fond of you", and as a result, we have a vulnerability with no ID to track it.

Here's a screen recording of a VM with March's Patch Tuesday level of updates. When you extract a file from a CAB file, no MotW is written. And as such, we get no protections that leverage the presence of MotW, such as SmartScreen, Smart Application Control, Office Protected View. In this case, we have a .URL file in a CAB. Double clicking on it results in a remote EXE running on your computer with no warning or other prompts. But, I suppose we all know that URL files are evil and have them blocked.

Someone on the Bad Site pointed out that the exploit only triggers upon entry to a Defender Offline scan. To which the author replied:

Exactly why I kept repeating the victim machine needed to have at least one offline scan initiated before the attack can be done without authentication.

So at the end of the day, I think GreatXML is a thing you can do do someone's computer that results in the comouter's administrator themselves getting an unexpected privileged command prompt.

So what? 🤷♂️

Nightmare Eclipse has posted another purported bitlocker bypass: GreatXML

This exploit claims to be able to bypass bitlocker on systems that have executed Microsoft Defender Offline at some point in the past. This is done by replacing Recovery\WindowsRE\ReAgent.xml and placing unattend.xml in the WinRE partition.

I think the writeup is flawed in that the spawned CMD.EXE happens on the NEXT time that a Microsoft Defender Offline scan is triggered. And in order to trigger a Microsoft Defender Offline scan, you both need to be logged in to Windows, and also have admin credentials. And if you've already got that level of access, you can just turn off bitlocker.

The writeup for GreatXML suggests that the prerequisite is that Windows Defender Offline has been executed at some point in the past. And that after planting two files in WinRE, all you need to do is [Shift]-reboot into WinRE, and Windows will automatically go into Microsoft Defender Offline scan mode. But this is not the case in any of the 3 lineages of Win11 that I have handy.

If you only [Shift]-reboot into WinRE, you get the normal WinRE menu. Not anything related to Microsoft Defender Offline. Even after the placement of the specified files.

Well, bitskrieg is public.

While Microsoft "fixed" YellowKey as CVE-2026-45585 (and by "fixed", I mean they have provided manual steps that you can perform if you want to remove autofstx.exe from the WinRE registry BootExecute value), bitskrieg still works on such a system to achieve the same goal (getting access to a TPM-only Bitlocker encrypted disk, without knowing any credentials on the system). Though it requires a second computer, or a device that can communicate on a serial port. VM reproduction requires adding a serial port to the VM. Physical machines can reproduce the same with a supported USB-to-serial device.

1. Boot into WinRe (hold [shift] when clicking reboot button)
2. Go to a command prompt, ignoring the prompt to enter a bitlocker recovery key. (Click Skip this drive)
3. Enable Emergency Management Services (EMS) to use a serial port as the EMS port.

1. Reboot back into WinRe
2. From your other computer, connect to the serial port.
3. Type:

cmd
[esc]
tab
-

1. Enjoy your cmd.exe prompt (over serial) with a decrypted (assuming it's TPM-only) hard disk.

@christopherkunz
Reference?

@christopherkunz
Ah, so you've confirmed that it works?
With AI and clout seeking these days, we've long passed the "PoC exists on Github" thing having any meaning whatsoever. 😂

Personally, I couldn't get that one to do anything.

@christopherkunz
Yeah, I've seen what it claims to do.
But either they are hand-waving over a critical requirement of what it takes to repro, or it's fake.

@christopherkunz
😂

I miss the days when things like this were written by humans, using logic and facts. As opposed to statistically plausible slop.

@christopherkunz
I also tested another PoC and it was even more fake. i.e. it didn't even create a CLDAP structure that made sense.

I get that PoC||GTFO is a thing, but we've clearly entered a phase where it needs to be Verified PoC||GTFO. 🤦♂️

@christopherkunz
Yes, my test environments (unpatched Server 2016, 2022, and 2025) all had a maximum DNS suffix of 64 chars. (Longer isn't allowed)

@GossiTheDog
I only ended up with my list after seeing lots of unexpected URIs in the samples I've been pulling from VT, and decided to do some testing.

I recall something in my past where the use of \\example.com@80\DavWWWRoot\pwned.exe would be more likely to start the WebClient service automatically. But for .URL files, none of that is necessary.

@GossiTheDog
At least in my case, that's covered by the \\example.com\pwned.exe case.