Windows Zero-Days: Analyzing YellowKey and GreenPlasma Exploits

A security researcher, known as hyp3rlinx, has publicly disclosed proof-of-concept code for two unpatched Zero-Day vulnerabilities affecting the Microsoft Windows ecosystem. These vulnerabilities, dubbed YellowKey and GreenPlasma, target critical components of Windows security: full-disk encryption and local authorization. According to SecurityWeek, these findings highlight persistent gaps in the Windows security model that allow for local Privilege Escalation and the bypass of BitLocker protections.

While Microsoft has not yet assigned a CVE to either vulnerability, the public availability of exploit code increases the risk of adoption by various threat actors. Defenders must evaluate their exposure, particularly for devices in high-risk environments where physical access or local user access cannot be strictly monitored.

Analysis of YellowKey BitLocker bypass physical access

The YellowKey vulnerability represents a specialized threat to data-at-rest protections. BitLocker is a core security feature designed to prevent unauthorized data access on lost or stolen devices. However, the YellowKey BitLocker bypass physical access exploit demonstrates that a user with direct access to the hardware can circumvent these protections.

Technically, the exploit focuses on how Windows handles BitLocker recovery and the availability of the clear key in specific states. If a device is not properly decommissioned or if it is left in a state where the encryption keys are accessible in memory or via the hardware interface, YellowKey can facilitate the extraction of the volume master key. This allows an attacker to decrypt the drive without the user’s password or PIN. The primary risk profile for this TTP includes corporate laptops and workstations that are subject to theft or unauthorized physical tampering.

GreenPlasma Windows privilege escalation exploit

While YellowKey focuses on data access, GreenPlasma targets the integrity of the operating system. The GreenPlasma Windows privilege escalation exploit allows a standard user account to elevate its permissions to the SYSTEM level. This is achieved by exploiting flaws in the way Windows manages local security tokens or inter-process communication mechanisms.

In a typical attack scenario, a threat actor gains initial access via Phishing or other means. Once inside the system, they use GreenPlasma to bypass User Account Control (UAC) and gain full administrative control. This level of access is a prerequisite for more advanced activities, such as disabling security software, installing persistent backdoors, or performing Lateral Movement across the network.

Detection and Strategic Response

Security teams must identify how to detect GreenPlasma exploit activity within their environments. Since this is an LPE vulnerability, defenders should focus on monitoring for unusual parent-child process relationships. Specifically, SOC analysts should look for standard user processes spawning high-integrity shells or unexpected calls to security-sensitive APIs.

To mitigate the risk of these zero-days before an official patch is released, organizations should prioritize the following actions:

• Enhance EDR Monitoring: Configure your EDR to alert on suspicious elevation attempts and the execution of unverified scripts that match known PoC behaviors.
• Physical Security: Enforce strict policies regarding the physical security of portable devices and use hardware-based protections such as TPM (Trusted Platform Module) with enhanced PIN requirements to raise the bar for BitLocker bypasses.
• Log Aggregation: Ensure that SIEM platforms are ingesting local security logs to identify any IoC related to account manipulation or privilege changes.
• Principle of Least Privilege: Minimize the number of users with local administrative rights to reduce the attack surface for local exploits.

Until Microsoft provides a formal fix, these vulnerabilities remain a viable path for attackers to gain deep persistence on Windows systems. Organizations should treat these disclosures as high-priority risks in their vulnerability management programs.