Keyhole – Forge own Windows Store licenses

The blog post discusses a newly discovered exploit named "Keyhole," which allows users to bypass Microsoft's Client Licensing Platform (CLiP) and activate any Microsoft Store app or Windows edition. The researchers found that a valid ECDSA key for signing XML licenses is stored in an unobfuscated form within the clipup.exe binary, enabling unauthorized license creation. By manipulating license blocks, they discovered that data placed after the signature block is not checked, allowing them to override existing license data. This exploit effectively undermines CLiP's DRM system, enabling the creation of licenses for various Microsoft products, including Windows itself. The researchers initially celebrated their findings but later learned that Cisco TALOS had reported the same vulnerability to Microsoft, categorizing it as a "privilege escalation." The researchers expressed disappointment over the lack of recognition for their work and the subsequent patch that would close the exploit. They have since released their findings and tools for others to explore CLiP further.

- The "Keyhole" exploit allows bypassing Microsoft's CLiP for unauthorized license creation.

- A valid ECDSA key in clipup.exe enables signing of XML licenses.

- License blocks can be manipulated by placing data after the signature block, overriding previous data.

- Cisco TALOS reported the vulnerability to Microsoft, leading to a patch that closes the exploit.

- The researchers have shared their findings and tools for further exploration of CLiP.