CVE-2023-38146

ThemeBleed CVE-2023-38146 エクスプロイトの PoC Windows 11 テーマ https://github.com/gabe-k/themebleed に大きく影響を受けています。元のツールは Windows でのみ動作するため、この PoC を書くことにしました。 impacket の smbserver.py の改変コードを使用しています https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 参考情報:...

ThemeBleedPy

gabek が C による初期 PoC を作成し、実際にこの CVE を発見してくれたことに多大な感謝を捧げます。これは彼のコードを Python でリメイクしたもので、彼のステージファイルを再利用しています。 初期 PoC を見るには、彼のページはこちら: https://github.com/gabe-k/themebleed ThemeBleedPy CVE-2023-38146 "ThemeBleed" に対する Python を使用した概念実証 PoC です。 要件: このプログラムは Impacket の SMB サーバー を使用し、smb2Create...

MemoryModulePP

MemoryModulePP memorymodule:https://github.com/fancycode/MemoryModule メモリからDLLをロードするライブラリ memorymoduleから変更。例外をサポート...

CVE-2024-28589

CVE-2024-28589 Windows용 Axigen Mail Server에서 모든 버전 10.5.18까지 영향을 주는 취약점이 발견되었으며, 이는 로컬 권한 상승을 허용합니다. 설명: Axigen Mail Server는 world-writable 디렉토리에서 안전하지 않은 DLL 로딩으로 인해 로컬 권한 상승에 취약한 것으로 밝혀졌습니다. SYSTEM 권한으로 실행되는 "Axigen Mail Server" 서비스 시작 시, 존재하지 않는 디렉토리를 검색합니다. 로컬 접근 권한이 있는 공격자는 이 디렉토리를 생성하고 악성 D...

CVE-2021-40444

CVE-2021-40444 PoC 悪意のあるdocxジェネレーターで、CVE-2021-40444（Microsoft Office Wordのリモートコード実行）を悪用します。 このスクリプトの作成は、実際に使用されたサンプル（docxファイル：938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52）のリバースエンジニアリングに基づいています。 まずlcabをインストールする必要があります（sudo apt-get install lcab） 手動での再現手順はREPRODUCE.mdを参照してください。...

CVE-2021-1675-PrintNightmare

CVE-2021-1675-PrintNightmare 動作する PowerShell POC PowerShell スクリプトは https://github.com/calebstewart/CVE-2021-1675 からコピーしたものです。 Caleb Stewart と John Hammond に敬意を表します。 手元に動作する POC を置いておきたかっただけです。カスタム DLL と、難読化した PowerShell スクリプトを追加しました。 難読化したスクリプトは、「C:\windows\tracing」ディレクトリから「printed.dll」という名前の DLL...

FalconFlank

FalconFlank Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to...

CVE-2026-68955

The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...

CVE-2026-68955

The Rakuten Kobo Desktop Application Windows installer is vulnerable to DLL search-order hijacking (CWE-427). The installer's uncontrolled DLL search path allows a crafted DLL placed in the same directory to be loaded when the installer runs, leading to arbitrary code execution with the privilege...

The vulnerability of the SAP GUI graphical user interface for Windows relates to deficiencies in the mechanism for calling system libraries, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SAP GUI graphical user interface for Windows relates to deficiencies in the mechanism for calling system libraries. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a...

CVE-2026-78574 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-77699

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699

ManageEngine Endpoint Central (Zohocorp) versions below 11.5.2605.01 are susceptible to a local privilege escalation caused by loading a DLL from an untrusted path . An attacker with low-level local access and the ability to prompt a user for interaction could exploit this to gain elevated privil...

CVE-2026-77699 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

EUVD-2026-72337

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

PT-2026-86675

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-9634

CVE-2026-9634 affects Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe). The binary searches system path directories for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. A l...

The vulnerability of the Cross Device Service for Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Cross Device Service for Windows operating systems is related to deficiencies in access control when processing the enabled parameter of the SeImpersonatePrivilege service token, as a result of loading the malicious CrossDeviceStreaming.Source.dll library. Exploiting this...