Stabilized PoC for the Windows Defender TOCTOU LPE. Original research by Tom Gallagher, Igor Tsyganskiy, and Jeremy Tinder with original PoC by Nightmare-Eclipose
This version seems to work everytime without hanging at random points.
- Configurable timeout with fallback
- Uses existing VSS snapshot
- Prevents folder locking due to cloud sync issues
- Headless Support
Check config.h and adjust for compatibility with C2 frameworks or whatever you desire to do.
Visual Studio 2019+, Release x64.
https://github.com/Nightmare-Eclipse/BlueHammer
Original research: Tom Gallagher, Igor Tsyganskiy, Jeremy Tinder