Researcher Releases BlueHammer Exploit for Windows Zero-Day

A security researcher using the alias Chaotic Eclipse published exploit code on April 3 for an unpatched Windows vulnerability known as BlueHammer, escalating tensions with Microsoft over its handling of vulnerability reports.

The flaw, classified as a zero-day because Microsoft has not yet released a patch, enables local privilege escalation on Windows systems. It combines a time-of-check-to-time-of-use, or TOCTOU, issue with path confusion, allowing an attacker with initial low-level access to elevate privileges to SYSTEM level, the highest administrative control on a Windows machine. Once achieved, attackers can access the Security Account Manager database, which stores password hashes for local accounts, potentially leading to full system compromise, such as spawning a SYSTEM-privileged shell.

Chaotic Eclipse, who also operates under the alias NightmareEclipse, released the proof-of-concept code on GitHub alongside a post expressing frustration with Microsoft's Security Response Center, or MSRC. "I was not bluffing Microsoft and I'm doing it again," the researcher wrote. "Unlike previous times, I'm not explaining how this works, y'all geniuses can figure it out. Also, huge...