OFFSITE.DARK
← Signals

Aug 30, 2026

3 min

Project Nightcrawler

  • avast
  • gen-digital
  • sandbox
  • privilege-escalation
  • windows
  • lpe
  • nightcrawler

news

PrettyPrague: Avast Sandbox Elevation of Privilege

NightmareEclipse PoC claims SYSTEM via Avast Antivirus sandbox on patched Win11 25H2, including SAM dump; Gen Digital says a fix is in product updates.

Summary

PrettyPrague is a local elevation-of-privilege proof-of-concept published 2026-08-30 by NightmareEclipse against Gen Digital Avast Antivirus. The author claims the chain works against fully patched Avast on Windows 11 25H2, abuses a vulnerability in the Avast sandbox, dumps the SAM database, and spawns a SYSTEM shell. The README also speculates that sibling Gen Digital products (AVG, Norton) may share the surface.

Gen Digital confirmed to SecurityWeek that a vulnerability existed in some of its products, including Avast Antivirus, and stated the issue has since been fixed in software updates. Widespread exploitation has not been confirmed in the coverage indexed here.

OFFSITE.DARK indexes the Nightcrawler drop and vendor confirmation. We did not discover or weaponize this flaw.

Key Findings

FindingDetail
ProductAvast Antivirus (author: any version at drop time); possible Gen Digital family overlap
ClassLocal privilege escalation via sandbox
Claimed outcomeSYSTEM shell + SAM dump
Lab claimFully patched Avast + Windows 11 25H2
Published2026-08-30
Vendor status (as of 2026-09-07)Fix released (Gen Digital / SecurityWeek)
Network RCENo — local code execution required

What is claimed

Antimalware sandboxes run privileged inspection of untrusted files. PrettyPrague’s public claim is that a logic/trust bug in that sandbox lets a local user coerce privileged Avast components into dumping credential material and launching a SYSTEM shell. Implementation details of the PoC are omitted here.

The interesting vendor fact is speed: unlike ShieldBreak (Microsoft shipped engine 1.1.26080.3 on 2026-09-03; ShieldCrash already contests that close-out) and FalconFlank (workaround-only), Gen Digital is reported as already patched.

Cluster context

PrettyPrague sits in the same late-August / early-September NightmareEclipse AV/EDR cluster as HardBreacher, GreenSection, FalconFlank, ShieldBreak, and ShieldCrash.

Impact

  • Unpatched Avast (and possibly related Gen Digital SKUs) become a SYSTEM escalation path after a standard-user foothold.
  • SAM dump in the published outcome is a credential-theft event, not just a demo shell — rotate local/domain secrets if a host ran the vulnerable product after 2026-08-30 without the vendor update.
  • Sibling-product speculation (AVG/Norton) means inventory should not stop at the Avast brand.

Mitigation

  1. Apply current Avast / Gen Digital product updates; confirm the PrettyPrague-era sandbox fix is present.
  2. Inventory AVG, Norton, and other Gen Digital endpoint SKUs for the same update train.
  3. If a host was exposed: treat as potential SAM/credential exposure; rotate local admin and cached secrets; hunt for unexpected SYSTEM shells around Avast sandbox activity.
  4. Do not run Nightcrawler samples on production images.

Related Signals

Sources

→ Source