Friday, 15 May 2026

MiniPlasma, a powerful LPE

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512


This one is accidental, I didn't even think cldflt.sys had that vulnerability. Turns out CVE-2020-17103 patch is just not present at all ?


The new PoC was tested against fully patched Windows 11 and Windows Server 2025 and managed to flawlessly spawn a SYSTEM shell.


https://github.com/Nightmare-Eclipse/MiniPlasma

-----BEGIN PGP SIGNATURE-----


iHUEARYKAB0WIQRJTvAf/AWVhAKEeb7FFoRCS0/SbAUCaggLWQAKCRDFFoRCS0/S

bHKSAP4/bkKYCDTKZvq5WoUsWKuYgWBvlfun8KYJtNgYREezVAEAj8cg30Pjcjcu

REzr4eniahPoc6bleEEos0PwVOUa5AA=

=oct9

-----END PGP SIGNATURE-----


at

5 comments:

  1. John16 May 2026 at 08:41

    This comment has been removed by the author.

    ReplyDelete
  2. UncannyDolphin16 May 2026 at 15:31

    Bro I’ve never really analyzed Microsoft drivers but third party drivers are full of vulnerabilities and Microsoft doesnt give a fuck. One driver I found even has a public cve from 2025 assigned and it is not even blacklisted. Vulnerability still there, driver still working like.

    ReplyDelete
  3. Nossy16 May 2026 at 22:48

    Thanks for posting!

    ReplyDelete
  4. Nossy24 May 2026 at 20:50

    Is this the same level as nt authority? How does it differ from advnacedrun by nirsoft

    ReplyDelete
  5. Nossy2 June 2026 at 22:53

    https://web.archive.org/web/20260516071853/https://github.com/Nightmare-Eclipse/MiniPlasma

    ReplyDelete

Subscribe to: Post Comments (Atom)

Moving to new blog, avoiding google censorship,

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Moving from blogger since google started flagging personal research blogs as "malware...

  • Public disclosure
    I was not bluffing Microsoft and I'm doing it again. https://github.com/Nightmare-Eclipse/BlueHammer Unlike previous times, I'm not ...
  • July 14th
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Okay, So let me get this straight, when I actively asked you to communicate with me, you ref...
  • We're doing silent patches now huh, also a quick note about YellowKey
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I just noticed that Microsoft silently patched the RedSun vulnerability, no CVE, no nothing,...