juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

CVE-2024-1403

CVE-2024-1403 Progress OpenEdge 認証バイパス Progress OpenEdge CVE-2024-1403 のエクスプロイト概念実証（PoC）です。 ブログ記事 詳細はこちら: https://www.horizon3.ai/attack-research/cve-2024-1403-progress-openedge-authentication-bypass-deep-dive 使用法 以下の jar ファイルのご自身のバージョンを用意する必要があります: progress.jar oeauth-12.8.-.jar osmetrics.jar...

juicy-potato

Juicy Potato ゴールデン特権の悪用 RottenPotatoNG を甘くしたバージョンで、少しだけ汁（ジュース）を加えました。つまり、Windows サービスアカウントから NT AUTHORITY\SYSTEM へのもう一つのローカル特権昇格ツール です。 概要 RottenPotatoNG とその亜種は、BITS サービス が 127.0.0.1:6666 に MiTM リスナーを持ち、SeImpersonate または SeAssignPrimaryToken 権限を持つ場合に基づく特権昇格チェーンを利用します。Windows ビルドのレビュー中に、BITS...

CVE-2020-5752

CVE-2020-5752: Druva inSync ローカル特権昇格 Druva inSync Windows Client（v6.6.3以下）用のC言語ベースのエクスプロイトです。このアプリケーションはポート6064でRPCサービスを公開しており、パストラバーサルによるコマンドインジェクションに対して脆弱です。これにより、ローカルユーザーがNT AUTHORITY\SYSTEMとして任意のコマンドを実行できるようになります。 脆弱性の詳細 CVE: 2020-5752 テスト環境: Windows 10 x64 権限レベル: ローカル特権昇格 LPE 使用方法 1. コンパイル...

CVE-2019-12889

CVE-2019-12889 Summary An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploi...

CVE-2026-92369

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

CVE-2026-92369

TeamViewer Full Client and Host on Windows prior to version 15.82 are vulnerable to a TOCTOU race condition within the installer rollback mechanism. A local low-privileged attacker can exploit this by replacing rollback backup files in a user-writable temporary directory before an elevated instal...

CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

PT-2026-102646

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description Improper path validation in the local IPC Inter-Process Communication service allows a local authenticated user with low privileges to perform arbitrary file writes with...

PT-2026-102662

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the installer rollback mechanism on Windows. This occurs when a local low-privileged attacker replaces rollback...

CVE-2026-57239

Foxit PDF Reader LPE Foxit PDF Readerのアップデーターサービスを介してNT AUTHORITY\SYSTEM権限を取得できる、CVE-2026-3775/CVE-2026-3780およびCVE-2026-57239の概念実証エクスプロイトです。 ビルド バイナリをビルドし、ターゲットに配置して実行するだけです。 cargo build --release 使い方 このプログラムには3つの主要エントリーポイントがあります:...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153: Improper Privilege Management

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-76159

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

CVE-2026-76159 Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208: Incorrect Permission Assignment for Critical Resource

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-0299

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...