GreatXML Bypasses BitLocker With 2 Files, Granting SYSTEM Shell on Scanned Windows PCs
Updated
Updated · Security Affairs · Jun 11
GreatXML Bypasses BitLocker With 2 Files, Granting SYSTEM Shell on Scanned Windows PCs
3 articles · Updated · Security Affairs · Jun 11
Summary
Chaotic Eclipse published a working GreatXML proof of concept on June 10 that opens a full SYSTEM shell in Windows Recovery Mode and exposes the BitLocker-protected volume.
Two copied items—an unattend.xml file and a Recovery directory—let the exploit abuse Defender Offline Scan artifacts left on the recovery partition after WinRE malware scans.
Any machine that has ever run Defender Offline Scan is described as automatically vulnerable; the attack needs brief physical access or another way to write to the recovery partition.
No patch exists yet, and the researcher said systems that never used Offline Scan may still be exploitable if an attacker can force the required recovery state.
GreatXML follows RoguePlanet and several other recent Windows zero-days released amid Chaotic Eclipse's dispute with Microsoft over report handling, account access and compensation.