🛡️ ShieldBreak Enterprise Patcher & Installer

An enterprise security tool by UBITQUITY, INC. and NETTWERKED.org.

---

📝 Executive Summary

Hello, GitHub community. Nathan Wosnack here.

Following the release of our initial PowerShell mitigation for the "ShieldBreak" Local Privilege Escalation (LPE) Zero-Day in Windows Defender, we received feedback from enterprise system administrators and node operators. Many highly-secured environments enforce strict PowerShell execution policies (e.g., Restricted or AllSigned), making the deployment of raw .ps1 scripts difficult at scale via SCCM, Intune, or active directory GPOs.

To solve this, we are releasing the ShieldBreak Enterprise Patcher.

This repository contains a standalone, compiled C# console application and an Inno Setup automated installer. It securely applies the necessary Access Control List (ACL) lockdowns to vulnerable temporary directories without relying on the PowerShell execution engine, allowing for silent, fleet-wide deployment.

⚙️ How It Works

The Vulnerability: ShieldBreak leverages a Time-of-Check to Time-of-Use (TOCTOU) flaw via directory junctions to trick MsMpEng.exe (SYSTEM) into overwriting protected OS binaries.

The Mitigation: This executable explicitly denies the BUILTIN\Users group the CreateDirectories permission in C:\Temp and C:\Windows\Temp. By breaking the ability for standard users to create directory junctions in these locations, the exploit chain is neutralized.

📦 Repository Contents

• ShieldBreakPatcher.cs - The core C# .NET source code that modifies the target ACLs.
• ShieldBreak_Installer.iss - The Inno Setup configuration script used to package the .exe into a professional, silent-capable Windows Installer.
• Output/ - Download pre-compiled binaries here.

---

🛠️ Deployment & Build Instructions

Option A: Fleet Deployment (Pre-Compiled)

For deployment via Microsoft Endpoint Configuration Manager (SCCM), Intune, or PDQ Deploy:

1. Download ShieldBreak_Mitigation_Setup.exe from the Releases page.
2. Deploy the executable to your endpoints using the silent flag:

   ShieldBreak_Mitigation_Setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART