554 matches found
CVE-2024-1403
CVE-2024-1403 Progress OpenEdge Authentication Bypass An exploit proof of concept for Progress OpenEdge CVE-2024-1403. Blog Post More details here: https://www.horizon3.ai/attack-research/cve-2024-1403-progress-openedge-authentication-bypass-deep-dive Usage You must provide your own versions of t...
juicy-potato
Juicy Potato ゴールデン特権の悪用 RottenPotatoNG を甘くしたバージョンで、少しだけ汁（ジュース）を加えました。つまり、Windows サービスアカウントから NT AUTHORITY\SYSTEM へのもう一つのローカル特権昇格ツール です。 概要 RottenPotatoNG とその亜種は、BITS サービス が 127.0.0.1:6666 に MiTM リスナーを持ち、SeImpersonate または SeAssignPrimaryToken 権限を持つ場合に基づく特権昇格チェーンを利用します。Windows ビルドのレビュー中に、BITS...
juicy-potato
Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...
CVE-2019-12889
CVE-2019-12889 Summary An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploi...
CVE-2026-76159
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...
CVE-2026-57239
Foxit PDF Reader LPE 针对 CVE-2026-3775/CVE-2026-3780 和 CVE-2026-57239 的概念验证漏洞利用程序，可通过 Foxit PDF Reader 更新服务获取 NT AUTHORITY\SYSTEM 权限。 构建 直接编译二进制文件，将其放到目标系统上并运行即可。 root@kitploit: cargo build --release 用法 该程序有三个主要入口点：check、exploit 和 cleanup。参数的作用应该很清楚。默认情况下，exploit 之后会自动调用...
CVE-2020-5752
CVE-2020-5752: Druva inSync Local Privilege Escalation A C-based exploit for the Druva inSync Windows Client v6.6.3 and below. The application exposes an RPC service on port 6064 that is vulnerable to command injection via path traversal. This allows a local user to execute arbitrary commands as ...
EUVD-2026-63896
Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...
CVE-2026-0299
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...
CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...
EUVD-2026-57239
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...
PT-2026-71097
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITYSYSTEM...
windows7-ctf-lab
Windows 7 Chained CTF Lab A multi-stage, boot-to-root cyberse...
CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...
CVE-2026-13079
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and...
CVE-2026-13079
CVE-2026-13079 describes a local privilege escalation in the WatchGuard Mobile VPN with SSL client for Windows . The issue allows a local attacker to escalate to NT AUTHORITY\SYSTEM on the machine hosting the Windows client. Affected scope includes the Windows client versions up to and including ...
PT-2026-55325
Name of the Vulnerable Software and Affected Versions WatchGuard Mobile VPN with SSL client for Windows versions prior to 2026.3 Description A local privilege escalation issue allows an attacker with local access to the machine where the client is installed to elevate their privileges to NT...
EUVD-2026-28530
NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to improper privilege checks...