tc4dy/CVE-2026-41091-PoC-Exploit
PoC files
7 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a C++ exploit for CVE-2026-41091, a local privilege escalation vulnerability in Microsoft Defender. It uses NTFS junctions, oplocks, and the Cloud Files API to trick Defender into writing a payload to System32, then activates a COM service to execute it as SYSTEM.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of source code for a CVE-2026-41091 local privilege escalation proof-of-concept exploit targeting Microsoft Defender. The code implements a documented exploit chain using oplocks, NTFS junctions, and Cloud Files API to copy a file to System32 and activate a COM service. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The artifact's behavior is consistent with its stated purpose as a PoC exploit.
Classification basis and observed behavior
Classification basis
The code is designed to exercise the vulnerability by performing privilege escalation: it writes a file to a protected system directory and executes it with SYSTEM privileges. The readme explicitly states it is a 'full working Proof of Concept (PoC) exploit' for local privilege escalation.
readme.md:17full_poc.cpp:401-405full_poc.cpp:407-411Requirements
- Low-privileged local user account on a vulnerable Windows system with Microsoft Defender enabled.
readme.md:17 - Microsoft Malware Protection Engine version < 1.1.26040.8.
readme.md:52
Observed behavior
- Creates a working directory and writes a reversed EICAR test string to a bait file to trigger Microsoft Defender scanning.
full_poc.cpp:247-270 - Monitors for Volume Shadow Copy (VSS) snapshot creation by querying the \Device object directory.
full_poc.cpp:47-132 - Creates batch oplocks on the bait file to control timing and gain exclusive access.
full_poc.cpp:134-159 - Renames the working directory and creates an NTFS junction pointing to C:\Windows\System32.
full_poc.cpp:172-207 - Copies the bait file to System32 as TieringEngineService.exe.
full_poc.cpp:272-274 - Activates the Storage Tiers Management COM service to execute the dropped payload as SYSTEM.
full_poc.cpp:276-286
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Oplock abuse, NTFS junction creation, Cloud Files API placeholder, COM activationThe full_poc.cpp implements a multi-step exploit chain to achieve local privilege escalation by tricking Defender into writing a file to System32 and then activating a COM service as SYSTEM.
full_poc.cpp:303-414 - Target File
- C:\Windows\System32\TieringEngineService.exeThe exploit copies a bait file to this system path, which is consistent with the documented privilege escalation technique.
full_poc.cpp:300 - Com Object
- CLSID_StorageTiersManagement {0x50d185b9-fff3-4656-92c7-e4018da4361d}The exploit activates this COM object to achieve SYSTEM-level code execution, a known technique for local privilege escalation.
full_poc.cpp:32full_poc.cpp:276-286
What the analysis did not establish
- Evidence includes only selected text files; 3 files (including 1 non-text media file) are omitted.
- The artifact's binary files were not inspected; the analysis is based solely on the provided source code and readme.
- Binary file solarflareploit.png (2,461,660 bytes) was not analyzed; it could contain hidden data.
- Two text files (total 2,193 bytes) were omitted from the evidence packet and not reviewed.
- The review is limited to static source code analysis; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.