GreatXML: Bypassing BitLocker on Windows 11 via a Recovery-Partition unattend.xml

GreatXML: Bypassing BitLocker on Windows 11 via a Recovery-Partition unattend.xml

by BitLockerBypassingDefenderexploitationRecovery mode

GreatXML is a one-file BitLocker bypass against Windows 11 24H2. Drop an attacker-controlled unattend.xml and ReAgent.xml into the root of the recovery partition; the next Defender Offline reboot honours them at the WinPE Setup pass and spawns an Administrator conhost.exe on top of the splash. The C: volume is already TPM-unsealed at that point, so the shell can cd C: and read everything. No crypto attack, no kernel exploit — just physical access plus two XML files. We reproduce the README, both XML files and both proof screenshots, explain why it works, and give a hardening checklist (TPM+PIN, reagentc /disable, recovery-partition integrity).

eventvwr.exe UAC bypass via mscfile registry hijack methodology diagram

Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack

by BypassingExploit DevelopmentPrivilege Escalationwindows

A walkthrough of the well-documented Windows UAC bypass that uses “eventvwr.exe”’s auto-elevate manifest plus a writable HKCU registry handler for the “mscfile” shell verb. Writing a single REG_SZ value under “HKCUSoftwareClassesmscfileshellopencommand and launching “eventvwr.exe” via “ShellExecuteEx” with the “runas” verb causes Windows to silently spawn the attacker’s payload at High integrity — no consent prompt. S12 reproduces the technique in a small C++ tool, demonstrates near-universal AV evasion on Kleenscan, and discusses the detection footprint.

Normal Callback call stack showing callback address visible in inspector

Callback Hell: Abusing Callbacks, Tail Calls, and Proxy Frames to Obfuscate the Stack

by BypassingEDREDR EvasionExploit DevelopmentRedTeamReverse Engineering

A walkthrough of klezVirus’ “Callback hell” — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward proxy frames, and a chained thread-pool dispatcher, while still recovering the callee’s return value via a MOV [REG], RAX gadget. Published under CC BY 4.0 and republished here in full, with all original figures, assembly listings, and the POC video.