The researcher known as Nightmare Eclipse has dropped another zero-day — this time a privilege escalation exploit targeting a Kaspersky endpoint security product.
Nightmare Eclipse, also known as Chaotic Eclipse, has released PoC exploits for many vulnerabilities in recent months, mainly Windows and Microsoft Defender flaws.
The researcher started dropping zero-days after growing frustrated with Microsoft’s handling of vulnerability reports. While many of the exploits remained at the PoC stage, a few ended up being exploited in the wild by malicious actors.
Over the weekend, Nightmare Eclipse released an exploit targeting a privilege escalation vulnerability in Kaspersky Endpoint Security. The exploit has been dubbed HardBreacher.
“The PoC is not in the best shape at all, it is basically duct tapped, I just managed to make it work and that’s all,” the researcher noted.
“The interesting part about this is the Kaspersky completely loses it when you take control over the UI process, you can cause it to stop functioning, grant/block access to files its not supposed to, if the PoC succeeds, the entire operating system becomes a hot mess,” the researcher added.
Contacted by SecurityWeek, Kaspersky said the underlying issue has been resolved.
“The corresponding fix is delivered via an automatic update, or users can trigger a database update manually,” Kaspersky stated.
Other exploits made public recently by Nightmare Eclipse include ShieldBreak, which allows an attacker to spawn a shell with System privileges, and LegacyHive, which enables privilege escalation.
Related: Log4j Remote Code Execution Scare
Related: Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs
Related: More Details Emerge on Exploited PaperCut Vulnerabilities
