# RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation

Windows Defender's cloud-placeholder write-back path performs SYSTEM-privileged writes to user-controlled paths, letting a standard user junction-redirect into System32 and gain SYSTEM.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Calif
- Disclosed: 2026-06-01
- CVE: CVE-2026-41091
- Write-up quality: 9/10
- Original: https://blog.calif.io/p/redsun-exploiting-windows-defenders
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-redsun-exploiting-windows-defenders
- Tags: area:os domain:desktop impact:privesc kind:research platform:research sev:high tech:windows technique:chained technique:race-window vuln:misconfiguration vuln:path-traversal vuln:privilege-escalation vuln:race-condition

**Target:** Windows Defender remediation workflow (MsMpEng.exe) on NTFS
**Root cause:** Defender's remediation rewrites cloud-tagged placeholder files back to their original user-controlled path with SYSTEM privileges without validating junction/symlink redirection; the write-back resolves through an attacker-set NTFS junction into System32.
**Steps:**
1. Write reversed EICAR string to `%TEMP%\RS-{GUID}\TieringEngineService.exe`, then reopen with `FILE_EXECUTE` to force a real-time scan.
2. Poll `\Device` via `NtQueryDirectoryObject` for a new `HarddiskVolumeShadowCopy*` device to confirm remediation started.
3. Open the bait file inside the new VSS volume with exclusive share mode and request `FSCTL_REQUEST_BATCH_OPLOCK` to freeze Defender.
4. POSIX-delete the EICAR file (`FILE_DISPOSITION_DELETE|POSIX_SEMANTICS`), register the dir via `CfRegisterSyncRoot` (PARTIAL hydration), `CfConnectSyncRoot` with zero callbacks, and `CfCreatePlaceholders` with same name/size (68 bytes).
5. Release first oplock so Defender hits the cloud placeholder and enters the write-back path.
6. Rename workdir aside (`MoveFileEx`), recreate empty dir, create a file with `FILE_SUPERSEDE`, map it (`CreateFileMapping`/`MapViewOfFile`) and place a second batch oplock.
7. On second oplock break, unmap, rename/delete the file, then set `IO_REPARSE_TAG_MOUNT_POINT` junction to `\??\C:\Windows\System32` via `FSCTL_SET_REPARSE_POINT`.
8. Release second oplock; poll `NtCreateFile` with `GENERIC_WRITE|FILE_SUPERSEDE` on `System32\TieringEngineService.exe` until it succeeds.
9. `CopyFile` self to that path, `CoCreateInstance` Storage Tiers Management COM object to launch it as SYSTEM.
10. SYSTEM copy connects to `\??\pipe\REDSUN`, gets session ID via `GetNamedPipeServerSessionId`, duplicates token, `SetTokenInformation(TokenSessionId)`, `CreateProcessAsUser` conhost.exe on user desktop.
**How found:** Observation that Defender (SYSTEM) performs file I/O on user-controlled paths; hypothesis that cloud-tagged placeholders divert remediation into a write-back path; used VSS device enumeration to detect remediation start and batch oplocks to convert the race into a deterministic window.
**Exploitation:** Unprivileged user triggers Defender scan on EICAR bait, uses VSS detection plus two batch oplocks to deterministically pause Defender, swaps bait for a zero-callback cloud placeholder to engage the write-back path, redirects the working dir to System32 via junction, then plants its own binary as TieringEngineService.exe and activates the Storage Tiers Management COM service to run it as SYSTEM, delivering a SYSTEM console to the user's session.
**Escalation:** Chains Defender remediation write-back + Cloud Files placeholder + NTFS junction + oplock timing into arbitrary SYSTEM write to System32, then COM service activation for full SYSTEM code execution and token/session pivot to user desktop.
**Insight:** SYSTEM services that remediate files in user-writable paths can be turned into privileged write primitives: detect their snapshot/scan start via Object Manager device enumeration, freeze them with batch oplocks, and swap the target for a reparse-tagged placeholder so their special-case code path writes back through an attacker junction.