{"uuid": "93fe21eb-1002-444e-a68c-3067b4e5eb0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32400", "content": "Black Hat Ethical Hacking\nNew Windows zero-day with public exploit lets you become an admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows zero-day with public exploit lets you become an adminPost Views: 404 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF-1.gif \nReading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.\nBleepingComputer has tested the exploit and used it to open to command prompt with SYSTEM privileges from an account with only low-level \u2018Standard\u2019 privileges.\n\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network.\n\nThe vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Researcher releases bypass to patched vulnerabilityAs part of the November 2021 Patch Tuesday, Microsoft fixed a \u2018Windows Installer Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2021-41379.\n\nThis vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft\u2019s fix.\n\nYesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.\n\n\u201cThis variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass,\u201d explains Naceri in his writeup.\u00a0\u201cI have chosen to actually drop this variant as it is more powerful than the original one.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nFurthermore, Naceri explained that while it is possible to configure group policies\u00a0to prevent \u2018Standard\u2019 users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway.\n\nBleepingComputer tested Naceri\u2019s \u2018InstallerFileTakeOver\u2019 exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with \u2018Standard\u2019 privileges, as demonstrated in the video below.\nThe\u00a0test was performed on a fully up-to-date Windows 10 21H1 build 19043.1348 install.\n\nWhen BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft\u2019s decreasing payouts in their bug bounty program.\n\n\u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d explained Naceri.\nSee Also: Microsoft Exchange servers hacked in internal reply-chain attacks Under Microsoft's new bug bounty program one of my zerodays has gone from being worth $10,000 to $1,000 \ud83d\udc80\n\n\u2014 MalwareTech (@MalwareTechBlog) July 27, 2020\nBE CAREFUL! Microsoft will reduce your bounty at any time! This is a Hyper-V RCE vulnerability be able to trigger from a Guest Machine, but it is just eligible for a $5000.00 bounty award under the Windows Insider Preview Bounty Program. Unfair! @msftsecresponse @msftsecurity pic.twitter.com/sJw3cjsliF\n\n\u2014 rthhh (@rthhh17) November 9, 2021\nBleepingComputer has reached out to Microsoft about the disclosed zero-day and will update the article if we receive a reply.\n\nAs is typical with zero days, Microsoft will likely fix the vulnerability in a future Patch Tuesday update.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools However, Naceri warned that it i[...]", "creation_timestamp": "2026-09-01T20:02:08.709949Z"}