johnnygreeme/cve-2023-36003Proof-of-concept exploit for CVE-2023-36003, a Windows Defender security feature bypass enabling privilege escalation and code execution evasion on unpatched Windows systems.
This repository contains a Proof of Concept (PoC) for CVE-2023-36003, a critical security feature bypass vulnerability affecting Windows Defender Exploit Protection.
CVE-2023-36003 is a vulnerability in Windows Defender that allows an attacker to bypass mitigation features designed to prevent exploit execution. Successful exploitation enables malware or malicious code to evade standard Exploit Protection mechanisms, increasing the risk of successful system compromise.
[!WARNING] This code is intended solely for educational, research, and authorized testing purposes. Unauthorized use of this software on production systems or without explicit permission is strictly prohibited. The author accepts no liability for any damage or misuse caused by this repository.
The vulnerability affects various versions of Windows 10, Windows 11, and Windows Server where Windows Defender Exploit Protection mitigations are enforced prior to the November 2023 security updates.
The flaw exists in how Windows Defender handles specific memory mitigation configurations or process creation techniques. An attacker can leverage this oversight to spawn a process that inherits or forces an environment where mitigations (such as ACG, DEP, or ASLR policies) are misapplied or disabled.
Open the solution file in Visual Studio and build the project in Release mode:
msbuild /p:Configuration=Release
Run the compiled binary from an elevated command prompt to test mitigation status:
poc.exe
To protect against this vulnerability, ensure that your Windows operating system is fully updated. Microsoft resolved this issue in the November 2023 Patch Tuesday release.