## https://sploitus.com/exploit?id=B4E1D3A6-7173-5883-9366-19658411A20B
# CVE-2023-36003: Windows Defender Exploit Protection Bypass PoC
This repository contains a Proof of Concept (PoC) for **CVE-2023-36003**, a critical security feature bypass vulnerability affecting Windows Defender Exploit Protection.
## Overview
CVE-2023-36003 is a vulnerability in Windows Defender that allows an attacker to bypass mitigation features designed to prevent exploit execution. Successful exploitation enables malware or malicious code to evade standard Exploit Protection mechanisms, increasing the risk of successful system compromise.
- **Vulnerability Type:** Security Feature Bypass
- **Affected Component:** Windows Defender / Exploit Protection
- **Discovered/Log Date:** November 2023 (Microsoft Patch Tuesday)
- **Impact:** Privilege Escalation / Code Execution Evasion
## Disclaimer
> [!WARNING]
> This code is intended solely for educational, research, and authorized testing purposes. Unauthorized use of this software on production systems or without explicit permission is strictly prohibited. The author accepts no liability for any damage or misuse caused by this repository.
## Affected Versions
The vulnerability affects various versions of Windows 10, Windows 11, and Windows Server where Windows Defender Exploit Protection mitigations are enforced prior to the November 2023 security updates.
## Technical Details
The flaw exists in how Windows Defender handles specific memory mitigation configurations or process creation techniques. An attacker can leverage this oversight to spawn a process that inherits or forces an environment where mitigations (such as ACG, DEP, or ASLR policies) are misapplied or disabled.
## Usage & Demonstration
### Prerequisites
- Windows 10/11 environment (Unpatched, pre-November 2023)
- Visual Studio (for compilation)
### Compilation
Open the solution file in Visual Studio and build the project in Release mode:
```bash
msbuild /p:Configuration=Release
```
### Execution
Run the compiled binary from an elevated command prompt to test mitigation status:
```cmd
poc.exe
```
## Remediation
To protect against this vulnerability, ensure that your Windows operating system is fully updated. Microsoft resolved this issue in the **November 2023 Patch Tuesday** release.
1. Open **Windows Update**.
2. Click **Check for updates**.
3. Install all cumulative updates for your version of Windows.
## References
- [Microsoft Security Advisory for CVE-2023-36003](https://microsoft.com)
- [NIST NVD CVE-2023-36003](https://nist.gov)