{"uuid": "1fc4a3ed-0adc-4ed3-83d9-6548e290984a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24084", "type": "seen", "source": "https://t.me/hacking_Attack/33024", "content": "Black Hat Ethical Hacking\nNew Windows 10 zero-day gives admin rights, gets unofficial patch\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows 10 zero-day gives admin rights, gets unofficial patchPost Views: 178 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nFree unofficial patches have been released to protect Windows users from a local privilege escalation (LPE) zero-day vulnerability in the\u00a0Mobile Device Management Service impacting Windows 10, version 1809 and later.\nThe security flaw resides under the \u201cAccess work or school\u201d settings, and it bypasses a patch released by Microsoft in February to address an information disclosure bug tracked as CVE-2021-24084.\n\nHowever, security researcher Abdelhamid Naceri\u00a0(who also reported the initial vulnerability)\u00a0discovered this month that\u00a0the incompletely patched\u00a0flaw could also be exploited to gain admin privileges after publicly disclosing the newly spotted bug\u00a0in June. \n\n\u201cNamely, as HiveNightmare/SeriousSAM\u00a0has taught us, an arbitrary file disclosure can\u00a0be upgraded to local privilege escalation if you know which files to take and what to do with them,\u201d 0patch\u00a0co-founder\u00a0Mitja Kolsek explained\u00a0today.\n\n\u201cWe confirmed this by using the procedure described in this blog post by Raj Chandel\u00a0in conjunction with Abdelhamid\u2019s bug \u2013 and being able to run code as local administrator.\u201d\n\nWhile Microsoft has most likely also noticed Naceri\u2019s June disclosure, the company is yet to patch\u00a0this LPE bug, exposing\u00a0Windows 10 systems with the latest November 2021 security updates to attacks.\n\nLuckily, attackers can only exploit the vulnerability if two very specific conditions are met:\n\n* System protection must be enabled on drive C, and at least one restore point created. Whether system protection is enabled or disabled by default depends on various parameters. \n* At least one local administrator account must be enabled on the computer, or at least one \u201cAdministrators\u201d group member\u2019s credentials cached.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unofficialpatches for all impacted Windows 10 systemsUntil Microsoft releases security updates to address this security issue (likely during next month\u2019s Patch Tuesday), the 0patch micropatching service\u00a0has released free and unofficial patches for all affected Windows 10 versions (Windows 10 21H2 is also impacted but is not yet supported by 0patch):\n\n1. Windows 10 v21H1 (32 & 64 bit) updated with November 2021 Updates\n2. Windows 10 v20H2 (32 & 64 bit) updated with November 2021 Updates\n3. Windows 10 v2004 (32 & 64 bit) updated with November 2021 Updates\n4. Windows 10 v1909 (32 & 64 bit) updated with November 2021 Updates\n5. Windows 10 v1903 (32 & 64 bit) updated with November 2021 Updates\n6. Windows 10 v1809 (32 & 64 bit) updated with May 2021 Updates\n\n\u201cWindows Servers are not affected, as the vulnerable functionality does not exist there. While some similar diagnostics tools exist on servers, they are being executed under the launching user\u2019s identity, and therefore cannot be exploited,\u201d Kolsek added.\nSee Also: New Windows zero-day with public exploit lets you become an admin \u201cWindows 10 v1803 and older Windows 10 versions don\u2019t seem to be affected either. While they do have the \u2018Access work or school\u2019 functionality, it behaves differently and cannot be exploited this way. Windows 7 does not have the \u2018Access work or school\u2019 functionality at all.\u201d\nThese FREE 0day patches for all affected versions (Windows 10 versions from v1809 to v21H1) are immediately available. They will remain free until Microsoft has provided an official fix fo[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.493426Z"}