@vintcessun: BitLocker加密后，按往常逻辑，没密码就是废的。结果GreatXML这个漏洞让人重新思考：原来只要对方的Windows Defender做过离线扫描，整块硬盘就不设防了。关键在想法的切入角度——不是暴力破解，而是通过WinRE里塞…

X AI KOLs Timeline 2026/06/12 00:40 新闻

bitlocker bypass vulnerability windows security greatxml defender

摘要

发现名为GreatXML的漏洞，利用Windows Defender离线扫描后的状态，通过WinRE注入unattend.xml绕过BitLocker加密，获得硬盘访问权限。

BitLocker加密后，按往常逻辑，没密码就是废的。结果GreatXML这个漏洞让人重新思考：原来只要对方的Windows Defender做过离线扫描，整块硬盘就不设防了。关键在想法的切入角度——不是暴力破解，而是通过WinRE里塞一个unattend.xml去触发自动部署流程，直接在恢复环境里开shell。绕过姿势有点离谱，但攻击面确实存在。

查看原文

查看缓存全文

缓存时间: 2026/06/12 12:58

BitLocker加密后，按往常逻辑，没密码就是废的。结果GreatXML这个漏洞让人重新思考：原来只要对方的Windows Defender做过离线扫描，整块硬盘就不设防了。

关键在想法的切入角度——不是暴力破解，而是通过WinRE里塞一个unattend.xml去触发自动部署流程，直接在恢复环境里开shell。绕过姿势有点离谱，但攻击面确实存在。

MSNightmare/GreatXML

Source: https://github.com/MSNightmare/GreatXML

GreatXML

GreatXML bitlocker bypass vulnerability

Steps to reproduce,

If defender offline scan was initiated in the victim machine at any point then there is no need to login, the machine is automatically vulnerable. You will have to copy “unattend.xml” and “Recovery” directory to the root of the recovery partition then reboot to WinRE using shift + click on restart button, if everything was done correctly, a shell with unrestricted access to the bitlocker volume will spawn.
If defender offline scan was never initiated then you have to either login and initiate it yourself or figure out a way to boot into WinRE in offline scan state (I believe it should be very possible to do so without logging in) and follow steps above

If everything is done properly, this should be the result

BottomText TopText