Exploitation Tools

Windows Downdate – Mastering The Art Of OS Downgrade Attacks

A tool that takes over Windows Updates to craft custom downgrades and expose past fixed vulnerabilities. Presented at Black Hat USA 2024 Briefings and DEFCON 32 under the title “Windows Downdate: Downgrade Attacks Using Windows Updates”.

Using Windows Downdate you can downgrade critical OS components, DLLs, Drivers, the NT kernel, the Secure Kernel, the Hyper-V hypervisor, Credential Guard and much more!

Setup

To install Windows Downdate, follow the steps below.

  1. Clone this repository
  2. Launch CMD and change directory to the cloned repository directory
  3. Run the following command
python311 setup.py install
  1. You can now execute Windows Downdate

Release Binary

Windows Downdate also supports PyInstaller pre-compiled binary that you can download here

Usage

Windows Downdate operates on a config XML file that specifies the files to downgrade

windows_downdate.py --config-xml <CONFIG XML PATH> <ADDITIONAL ARGS>

Config XML Format

<Configuration>
    <UpdateFilesList>
        <UpdateFile source="path\to\source.exe" destination="path\to\destination.exe" />
    </UpdateFilesList>
</Configuration>

<Configuration>: The root element that encapsulates the entire configuration.

<UpdateFilesList>: A container element that holds one or more elements.

<UpdateFile>: Defines a single file downgrade operation.

source: The path of the downgrade source file. Note that if the source file does not exist, Windows Downdate attempts to retrieve its base version from the component store.

destination: The path of the downgrade destination file.

Simply put – take the XML snippet and insert <UpdateFile> elements, the source replaces the destination.

You can also refer to the examples directory as reference for finalized config XML files.

Execution Options

Windows Downdate supports two execution options.

1. Custom Downgrades

Windows Downdate supports crafting custom downgrades. To craft custom downgrade, you need to create a config XML file and just feed the tool with this config XML.

2. Downgrade Usage Examples

Windows Downdate has built-in usage examples with ready config XML files and vulnerable modules. The supported usage examples are listed below.

  1. CVE-2021-27090 Secure Kernel Elevation of Privilege Patch Downgrade
  2. CVE-2022-34709 Credential Guard Elevation of Privilege Patch Downgrade
  3. CVE-2023-21768 AFD Driver Elevation of Privilege Patch Downgrade
  4. Hyper-V Hypervisor Downgrade
  5. Kernel Suite Downgrade
  6. PPLFault Patch Downgrade
  7. VBS UEFI Lock Bypass
Tamil S

Tamil has a great interest in the fields of Cyber Security, OSINT, and CTF projects. Currently, he is deeply involved in researching and publishing various security tools with Kali Linux Tutorials, which is quite fascinating.

Recent Posts

MSI Analyzer – Analyzing Windows Installer Files For Vulnerabilities

This Python script for Linux can analyze Microsoft Windows *.msi Installer files and point out…

17 hours ago

BEAR-C2 : Simulated Command And Control Framework For APT Attack Research

Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks…

17 hours ago

Bearer – A Quick Guide To Scanning And Securing Your Application

Discover your application security risks and vulnerabilities in only a few minutes. In this guide…

17 hours ago

Waymore – A Comprehensive URL Retrieval And Archival Tool For Advanced Reconnaissance

The idea behind waymore is to find even more links from the Wayback Machine than…

18 hours ago

Pycript – A Versatile Burp Suite Extension For Encryption And Decryption

The Pycript extension for Burp Suite is a valuable tool for penetration testing and security…

18 hours ago

DependencyTrack 4.10.0 – Release Overview And Security Hashes

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and…

3 days ago