Exploit code is now available for a Windows privilege escalation vulnerability that Microsoft hasn’t patched yet. This vulnerability, which was previously reported privately, allows attackers to obtain SYSTEM or elevated admin privileges.

Called BlueHammer, the vulnerability was made public by a security researcher who wasn’t happy with Microsoft’s Security Response Center’s handling of the disclosure.

Because there’s no official patch or update to fix it, Microsoft considers this a zero-day vulnerability, according to their definition.

It’s unclear why the exploit code was released publicly. In a brief statement, the researcher, using the name Chaotic Eclipse, stated, “I was not bluffing Microsoft, and I’m doing it again.”

“Unlike before, I won’t explain how it works; you can figure it out yourselves. Thanks to MSRC leadership for making this possible,” the researcher added.

On April 3rd, Chaotic Eclipse, as Nightmare-Eclipse, released a BlueHammer vulnerability exploit repository on GitHub, expressing disbelief and frustration with Microsoft’s response to the security issue.

“I’m really wondering about the logic behind their decision. Did they know this would happen and still do what they did? Are they serious?”

The researcher also pointed out that the proof-of-concept (PoC) code has bugs that might affect its reliability.

Will Dormann, a principal vulnerability analyst at Tharros (previously Analygence), confirmed to BleepingComputer that the BlueHammer exploit works. He said the vulnerability is a local privilege escalation (LPE) that combines a TOCTOU (time-of-check to time-of-use) issue with path confusion.

He said that the issue is not an easy one to exploit, and it can give a local attacker access to the Security Account Manager (SAM) database, which includes password hashes for the local accounts.

With this access, attackers can gain SYSTEM privileges and potentially completely compromise the machine.

“At that point, attackers basically control the system and can do things like start a shell with SYSTEM privileges,” Dormann told BleepingComputer.

Some researchers who tested the exploit reported that the code did not work on Windows Server. This confirms Chaotic Eclipse’s point that there are bugs that could prevent it from working correctly.

Will Dormann added that on the Server platform, the BlueHammer exploit elevates permissions from non-admin to elevated administrator, a safeguard that requires the user to approve an operation that needs full system access temporarily.

While the motive behind Chaotic Eclipse/Nightmare-Eclipse’s disclosure is unknown, Dormann mentioned that MSRC requires a video of the exploit when submitting a vulnerability.

While this may help Microsoft assess reported vulnerabilities more efficiently, this increases the effort needed to submit a valid report.

Even though BlueHammer necessitates local access, it is still a significant risk since hackers can gain local access through tactics like social engineering, other software flaws, or credential-based attacks.

BleepingComputer reached out to Microsoft for comment on the BlueHammer vulnerability, and a spokesperson provided the following statement:

“Microsoft is dedicated to investigating reported security issues and updating affected devices to protect customers as quickly as we can. We also support coordinated vulnerability disclosure, an industry-standard practice that ensures issues are thoroughly investigated and resolved before public disclosure, protecting both customers and the security research community.” – Microsoft spokesperson.

Article updated on 4/7 to include Microsoft comment