{"uuid": "0f69f71f-5fd0-4ea1-aa97-7a8701af34f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32517", "content": "Black Hat Ethical Hacking\nMalware now trying to exploit new Windows Installer zero-day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Malware now trying to exploit new Windows Installer zero-dayPost Views: 143 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nMalware creators have already started testing a proof-of-concept exploit targeting a new Microsoft Windows Installer zero-day publicly disclosed by security researcher Abdelhamid Naceri over the weekend.\n\u201cTalos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability,\u201d said\u00a0Jaeson Schultz, Technical Leader for Cisco\u2019s Talos Security Intelligence & Research Group.\n\nHowever, as Cisco Talos\u2019 Head of Outreach Nick Biasini told BleepingComputer, these exploitation attempts are part of low volume attacks likely focused on testing and tweaking exploits for full-blown campaigns.\n\n\u201cDuring our investigation, we looked at recent malware samples and were able to identify several that were already attempting to leverage the exploit,\u201d Biasini told BleepingComputer.\n\n\u201cSince the volume is low, this is likely people working with the proof of concept code or testing for future campaigns. This is just more evidence on how quickly adversaries work to weaponize a publicly available exploit.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Zero-day bypasses Windows Installer patchThe vulnerability in question is a local privilege elevation bug found as a bypass to a patch Microsoft released during November 2021\u2019s Patch Tuesday to address a flaw tracked as CVE-2021-41379.\n\nOn Sunday, Naceri published a working proof-of-concept exploit\u00a0for this new zero-day, saying it works on all supported versions of Windows.\n\nIf successfully exploited, this bypass gives attackers SYSTEM privileges on up-to-date devices running the latest Windows releases, including Windows 10, Windows 11, and Windows Server 2022.\n\nSYSTEM privileges\u00a0are the highest user\u00a0rights\u00a0available to a Windows user and make it possible to perform any operating system\u00a0command.\n\nBy exploiting this zero-day, attackers with limited access to compromised systems can easily elevate their privileges to help spread laterally within a victim\u2019s network.\nSee Also: New Windows zero-day with public exploit lets you become an admin BleepingComputer has tested Naceri\u2019s exploit and used it to successfully open a command prompt with SYSTEM permissions from an account with low-level \u2018Standard\u2019 privileges.\n\n\u201cThe best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability,\u201d explained Naceri.\n\n\u201cAny attempt to patch the binary directly will break windows installer. So you better wait and see how Microsoft will screw the patch again.\u201d\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools \u201cWe are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim\u2019s machine,\u201d\u00a0a Microsoft spokesperson told BleepingComputer when asked for more details regarding this vulnerability.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.808883Z"}