RedSun: System user access on Win 11/10 and Server with the April 2026 Update (opens in new tab)

They kind of have to, though.

If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?

AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.

Because to get Ring0, you just need signed vulnerable driver.

There are tons of signed drivers to explore ;-)

Unlike Windows Defender which is passive aggressive.

It was not that bad. I remember when SP fixed a bunch of issues with bluetooth, and windows CD burning program was better than any of the Nero Burning ROMs, cause those became unusable overbloated.

Also, technically XP was Windows NT 5.1, so it was built on a solid basis.

Whereas 98 was still in the kinda DOS-based 9x line.

And I fully agree with you to not mention Windows Me.

> I don't think SP2 made much of a difference in the popularity of XP

The general knowledge was to wait until the SP were stable. This was hard. 4.0 had SP6, 2k had SP4.

> I don't think SP2 made much of a difference in the popularity of XP

SP1 was buggy as hell.

I agree with you on everything except the browser. I'm pretty sure I was using Firefox (or maybe Opera?) on Windows before the release of Vista. I know I was still using IE for some ActiveX web apps for a while. This was the era that I switched over to Linux full-time, but both Windows 2000 and XP were great OSes at this time. Linux was painful to adopt, but I really loved the promise of "full-control" over my computer.

My peeve today is how bad modern chat programs feel compared to the old instant messengers. The modern programs all feel slow and clunky in comparison. I felt that all of the messengers I used (MSN, AIM, ICQ) were more responsive than their modern day equivalents.

This is a misrepresentation. This command-line is the compiler invocation, and is not the equivalent to 'make' on Windows. The actual equivalent on Linux, in the same order of the arguments to cl.exe would be:

  cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib

  g++ -std=c++17 -Wall -O3 -DUNICODE -D_UNICODE -Wno-builtin-macro-redefined -o RedSun.exe RedSun.cpp -ladvapi -lole32 -luser32

I see no difference. One uses slash-demarcated arguments, the other uses hyphens. The g++ invocation is missing the flag for the exception handling model[1]. Otherwise, it is a matter of what you are used to. In fact, if you have MinGW, this exact command-line invocation will probably work correctly.

When you install the VS build tools you get nmake which processes most Makefiles just fine. Or you get a solution file, in which case you just open the solution in VS and press F5. Or if you are hung up about doing it in the command-line, it would be

  msbuild.exe foo.sln

Or with CMake, which has a cross-platform command-line,

  cmake --preset somepreset

Linux people who don't know Windows and complain that 'it looks like this' is my bugbear, when they can spend hours fixing a dumb in-tree driver with printf debugging that works plug-and-play on Windows.

[1]: https://learn.microsoft.com/en-gb/cpp/build/reference/eh-exc...

It’s getting warm above the equator, they may have shaved for the season.

I can't seem to find any system files replaced, and the .exe was never executed. I'm running this in a test VM, but from what I can see, Defender signatures have been updated to block this prior to execution.

The exploit, from my reading, needs to be executed in order to do it's thing, but Defender isn't allowing it to be written to the filesystem on download.

Intentionally?

Ignorance is bliss! Simply use docker in its (old) default setup, instead of podman, apptainer, docker-rootless ... and that world is yours.

Added bonuses are the incredible stupid integration with ufw on Ubuntu, images with laughable uid mapping, ...

How that shit got traction baffles me.

> And if the target uses sudo at all you don't even need an exploit!

Why would a target executable use sudo? There are proper mechanisms for automated elevation of permissions and sudo isn’t it.

sudo is designed for user interactivity. And by default prompts for a password. However some people get lazy and disable the password entry requirement.