Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Security researcher Abdelhamid Naceri, known online asNightmare Eclipse, this week dropped another zero-day exploit targeting Windows systems.
Dubbed SignDrop, the exploit allows a local user to elevate their privileges to System by abusing flawed logic in the Windows Common Log File System (CLFS).
CLFS parses complex log files in kernel mode and has long been an attractive target for threat actors. Last year, Microsoft introduced CLFS logfile authentication to mitigate exploitation, which relies on authentication codes to check file integrity.
SignDrop, Naceri says, exploits a vulnerability in how clfs.sys handles the creation of the authentication file ‘.cnpf’ during the creation of a log file.
The code responsible for creating/opening both container and log files will always open the container if the original log file is opened. If the container is empty, CLFS attempts to sign it regardless of whether the signature file exists.
A standard user can create...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
