Does FolderContentsDeleteToFolderDelete.exe Still Work on Windows 11 24H2?

[CyberGeeGee]

Hello,

I've been testing with the FolderContentsDeleteToFolderDelete.exe exploit and it has been working quite well on the latest build of Windows 10 22H2 and Windows 11 23H2.

However, I noticed on Windows 11 24H2, it will always fail for some reason. A simple test with the del /q C:\path\to\folder\* command will not succeed.
I know this exploit still relies on a race condition, but I've tried countless times with low CPU usage and it has not succeeded once on 24H2.

Have you experienced this lately as well and if so, any idea if Microsoft has changed something in the latest version that might interfere with this exploit? Note the FolderOrFileDeleteToSYSTEM exploit still works flawlessly.

Thanks,
G

[CyberGeeGee]

Looks like the latest updates for Windows 11 may have killed the ::$INDEX_ALLOCATION trick and that may be why the exploit no longer works. There are talks about it here as well: https://x.com/filip_dragovic/status/1881091708039131441