SECURE ENCLAVES FOR OFFENSIVE OPERATIONS (PART II)

Summary from the TLDR InfoSec newsletter

This post demonstrates how to exploit vulnerable Windows Secure Enclaves (VBS) by leveraging read-write primitives to achieve VTL1 code execution through ROP chaining and function table manipulation. It shows how CVE-2023-36880 and CVE-2024-21423 can be exploited in Microsoft Edge's preferences enclave to patch the VertValidTargetTable, enabling arbitrary function calls within the secure environment. The research resulted in practical sleep masking techniques for malware that hide implant memory from EDR detection by storing code in VTL1 while the implant sleeps, which has been integrated into the Outflank C2 and Beacon Booster tools.