On 30 August 2026 INFINITE NIGHTMARE dropped MSNightmare/PrettyPrague (commit 5e7e168) and we are cooking this blog while it is still hot. A zero-day that politely asks your antivirus to hand over the keys to the kingdom deserves a fresh write-up, not a stale advisory three weeks later.
PrettyPrague registers with Avast's sandbox, requests the protected Windows SAM from inside the sandbox, weakens the directory permissions on the redirected copy, and reads it from outside. The original SAM stays locked. Avast makes another one.
Tested on aswSnx.sys 26.8.1013.0, x64 Windows 11 with the paid Sandbox feature active. A disposable local administrator was present from the start. PrettyPrague disclosed local SAM hashes and completed the chain to SYSTEM.
