A newly discovered zero-day can potentially bypass BitLocker on Microsoft devices.
The well-known zero-day hunter Nightmare Eclipse has released a new exploit that he claims can bypass BitLocker. The vulnerability, named GreatXML, reportedly generates a command prompt with full access to BitLocker volumes on systems where a Microsoft Defender Offline scan has previously been performed.
The researcher published the code on GitHub and other platforms. GreatXML follows RoguePlanet, another zero-day that enables local privilege escalation and provides SYSTEM access.
How the BitLocker bypass works
According to Nightmare Eclipse, the exploit requires copying “unattend.xml” and the “Recovery” folder to the root of the recovery partition. A reboot into WinRE is then required via Shift-clicking Restart. If everything is executed correctly, a shell with unrestricted access to the BitLocker volume should appear.
A security researcher tested the steps and concluded that Nightmare Eclipse’s explanation may contain errors. In his tests, the command prompt only appeared during the next Defender Offline scan. Furthermore, admin privileges are required to trigger such a scan, which limits the practical feasibility of the exploit.
Microsoft confirmed to The Register that it is aware of RoguePlanet and is investigating the claims. The company has not yet responded regarding GreatXML. Microsoft did emphasize that none of the vulnerabilities were reported through official channels prior to publication.