Windows 0-day dropped by disgruntled researcher hands hackers System rights

Nightmare Eclipse, a researcher known for a contentious relationship with Microsoft, has recently revealed a new Windows zero-day vulnerability named SignDrop. This flaw allows local users to gain complete System rights on certain Windows versions. The vulnerability lies within the Common Log File System, a general-purpose logging service utilized by software clients operating in user-mode or kernel-mode.

By manipulating a privileged process like Windows Defender into opening a specially crafted Common Log File System (CLFS) container, an attacker with regular user privileges can abuse the elevated file creation to attain System-level access. Essentially, the attack exploits the relationship between the CLFS, Windows Defender, and Windows file permissions.

The exploit leverages Windows Defender to open a log file generated by a standard user by invoking ServerMpUpdateEngineSignature, a legitimate Defender function used for processing antivirus signature updates.