msnightmare/greatxml

GreatXML is a proof-of-concept security vulnerability disclosure. It demonstrates a method to bypass BitLocker, which is the disk encryption feature built into Windows that is supposed to prevent anyone without the password from reading the files on a locked drive. The vulnerability is tied to a feature called Windows Defender Offline Scan. When a machine has ever run an offline scan, the repository's author found that certain configuration files can be placed on the recovery partition of the drive. After rebooting into the Windows Recovery Environment (WinRE), the machine will spawn a command shell with unrestricted access to the BitLocker-protected volume, without requiring the encryption password or login credentials. If the offline scan has never been run, the attack requires first logging in to trigger the scan, or finding another way to boot into WinRE in offline scan mode without logging in first. The author notes they believe the latter should be achievable. The repository is very minimal. It contains two screenshots showing the result of a successful exploit and a short list of reproduction steps. There is no patch, no fix, and no detailed analysis of the underlying code path that causes the issue. This appears to be a raw vulnerability report rather than a finished research paper. This repository is relevant to security researchers, system administrators, and IT professionals who manage Windows machines with BitLocker enabled and need to understand the risk surface introduced by Windows Defender Offline Scan.