Last Updated: 2026-05-12T23:08:34Z
YellowKey Bitlocker Bypass Vulnerability
Bypasses a Bitlocker protected Windows Computer, spawning an unrestricted shell with access to the protected volume.
GreenPlasma Windows CTFMON Arbitrary Section Creation Elevation of Privileges Vulnerability
Creates an arbitrary memory section object in any directory object write-able by SYSTEM, leverageable into full privilege escalation.
The researcher responsible for RedSun and BlueHammer publicly disclosed two 0days today on github.
Chaotic Eclipse, also referred to in some places as Nightmare-Eclipse, is an alias for a security researcher who became frustrated with how Microsoft was handling the vulnerability disclosure processes. As a result of that frustration, they published a series of local privilege escalation techniques, dubbed BlueHammer, RedSun, and UnDefend.
Mitigations
Microsoft has released mitigation recommendations for YellowKey and assigned CVE-2026-45585.
The registry mitigation is very finicky. Adding a boot PIN is likely easier, if more inconvenient for end users.
Indicators of Compromise (IoCs)
| Value | Type | Description |
|---|---|---|
95F62703B343F111A92A005056975458 |
filename | YellowKey crafted TxF directory GUID placed under \System Volume Information\FsTx\ |
98F62703B343F111A92A005056975458 |
filename | YellowKey trigger file (0 bytes) in FsTxTemp\ |
FsTxKtmLog.blf |
filename | YellowKey KTM log base file |
FsTxLog.blf |
filename | YellowKey TxF log base file |
FsTxKtmLogContainer00000000000000000001 |
filename | YellowKey KTM log container |
FsTxKtmLogContainer00000000000000000002 |
filename | YellowKey KTM log container |
FsTxLogContainer00000000000000000001 |
filename | YellowKey TxF log container |
FsTxLogContainer00000000000000000002 |
filename | YellowKey TxF log container |
666fac8bd83d8363d1770d0de66eaa0b90b6c54a09988bf67c51f7e8c0fa1d22 |
sha256 | YellowKey FsTxKtmLog.blf |
6ac1febd94d0582c259ef5e89b1059bf307d5cddbb7bf935ef23b9700f8e2067 |
sha256 | YellowKey FsTxLog.blf |
c5f9d0c9bf3ba7539e1a34bf4cf1730872bc3c5c07ecc8635c501a62cc89d9dd |
sha256 | YellowKey FsTxKtmLogContainer00000000000000000001 |
07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541 |
sha256 | YellowKey FsTxKtmLogContainer00000000000000000002 |
35c02eaca58f71c6f8475f32cede2b0daf68328124f72be1b6feebd82ad57678 |
sha256 | YellowKey FsTxLogContainer00000000000000000001 |
e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d |
sha256 | YellowKey FsTxLogContainer00000000000000000002 |
\System Volume Information\FsTx |
filepath | YellowKey target directory for TxF payload |
HKCU\Software\Policies\Microsoft\CloudFiles\BlockedApps |
regkey | GreenPlasma volatile symbolic link target |
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation |
regkey | GreenPlasma registry value to prevent screen lock |
\Sessions\{sid}\BaseNamedObjects\CTF.AsmListCache.FMPWinlogon{sid} |
other | GreenPlasma Object Manager CTFMON target path |
\BaseNamedObjects\CTFMON_DEAD |
other | GreenPlasma default symbolic link target |
cldapi.dll |
other | GreenPlasma loaded DLL for CfAbortOperation |
NtCreateSymbolicLinkObject |
other | GreenPlasma abused NT API |
CfAbortOperation |
other | GreenPlasma abused Cloud Files API |
178896a15577b5b95dfb9208553f2891528ef21e8e063400307207ef4cfc8b09 |
sha256 | GreenPlasma.cpp source file |
https://github.com/Nightmare-Eclipse/YellowKey |
url | YellowKey exploit repository |
https://github.com/Nightmare-Eclipse/GreenPlasma |
url | GreenPlasma exploit repository |