Exploit doesn't work

[Salah-Code-Lab]

The Exploit doesn't work
even with all core defenses down
even without the definitions update
even with multiple other builds
your exploit fails
basically a piece of garbage
Yeah talk about
even after running it as system and editing the code to make it run as system

bool IsRunningAsLocalSystem()
{

HANDLE htoken = NULL;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &htoken)) {
	printf("OpenProcessToken failed, error : %d\n", GetLastError());
	return false;
}
TOKEN_USER* tokenuser = (TOKEN_USER*)malloc(MAX_SID_SIZE + sizeof(TOKEN_USER));
DWORD retsz = 0;
bool res = GetTokenInformation(htoken, TokenUser, tokenuser, MAX_SID_SIZE + sizeof(TOKEN_USER), &retsz);
CloseHandle(htoken);
if (!res)
	return false;

return false;

}

talk about a miss or miss

[MrWxlfz]

windows has released a patch. check your windows update history. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

[Salah-Code-Lab]

i know
i used a old version way before the patch and way before the malware definitions update for defender

[didotb]

The Exploit doesn't work
even after running it as system and editing the code to make it run as system

The exploit is a race condition, so it's a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others.

Not checking for NT AUTHORITY\SYSTEM doesn't do you any better. The better approach is to know which processes affects these conditions and increasing probability by having a pre-setup on these processes; such as how most race condition PoCs are setup to do.

It doesn't do anyone any better by complaining that it doesn't work, yet doing not even the bare minimum to try to make it work. Trying it out on different systems/versions/builds/patches doesn't do the trick.

[Salah-Code-Lab]

Hey Didotb, thank you for your reply.

Now I know that this exploit is a Race Condition, and yeah, sometimes they are a hit or miss. But here is the thing: an exploit is consistent when you install a Windows operating system on a virtual machine. You are installing the baseline without vulnerable drivers (sometimes Windows has them, don't get me wrong) and without third-party drivers. That way, whenever you run anything, if it succeeds on the baseline consistently, then it will work on other environments not all, but most of them.

My tests for running it as NT AUTHORITY\SYSTEM are a way of making this exploit run with the least amount of obstructions. I have attempted multiple ways, multiple environments, and multiple builds, and the exploit never, ever succeeded.

While, yes, the vulnerability is there, it relies on something heavily impractical. We won't be able to give it the same system state, the same timing, and, most of all, the same builds. That is what I am arguing about.

Oh, and I know in my first issue on this I talked in an impolite way, and I apologize. I was just mad about something else. Things happen.