PrintSpoofer

PrintSpoofer From LOCAL/NETWORK SERVICE to SYSTEM by abusing SeImpersonatePrivilege on Windows 10 and Server 2016/2019. For more information: https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/. Usage You can check the help message using the -h option. root@kitploit:...

CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

CouchPotato

CouchPotato Make sure you compile on your own to avoid detection.. certain strings are XOR at compile time.. I will not be publishing anymore binaries. Usage: CouchPotato.exe ip port Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin - NT system...

SharpEfsPotato

SharpEfsPotato Local privilege escalation from SeImpersonatePrivilege using EfsRpc. Built from SweetPotato by @EthicalChaos and SharpSystemTriggers/SharpEfsTrigger by @cube0x0. Usage root@kitploit: C:\tempSharpEfsPotato.exe -h SharpEfsPotato by @bugch3ck Local privilege escalation from...

DCOMPotato

Exploit collection for some Service DCOM Object local privalege escalation vulnerabilityby SeImpersonatePrivilege abuse writeup DCOM use RPCCIMPLEVELIDENTIFY as default impersonation level, for the default out-bound IUnknown call, see...

The vulnerability of the Cross Device Service for Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Cross Device Service for Windows operating systems is related to deficiencies in access control when processing the enabled parameter of the SeImpersonatePrivilege service token, as a result of loading the malicious CrossDeviceStreaming.Source.dll library. Exploiting this...

Exploit for CVE-2026-66804

CVE-2026-66804: Cross Device Virtual Camera EoP A standard Wi...

PT-2026-70703

Name of the Vulnerable Software and Affected Versions Windows 11 affected versions not specified Description Improper access control in the Windows Cross Device Service allows an authorized attacker to elevate privileges locally. The issue occurs because a standard user can create the...

EUVD-2020-5987

Malware in sbrugna...

EUVD-2025-9126

Malicious code in bioql PyPI...

The vulnerability of the Interactive Service (iservice) of the OpenVPN GUI software allows a malicious individual to gain unauthorized access to the user’s account.

The vulnerability of the Interactive Service iservice of the OpenVPN GUI software relates to deficiencies in access control when processing the SeImpersonatePrivilege parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the user account...

CVE-2025-0416

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows...

CVE-2025-0416

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows...

CVE-2025-0416 Valmet DNA Local privilege escalation through insecure DCOM configuration

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows...

CVE-2025-0416 Valmet DNA Local privilege escalation through insecure DCOM configuration

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows...

CVE-2021-3576 Privilege escalation via SeImpersonatePrivilege

Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrin...

Microsoft Windows Containers Privilege Escalation

Windows Containers: ContainerUser has Elevated Privileges Windows Containers: ContainerUser has Elevated Privileges Platform: Windows 10 20H2 not tested other versions Class: Elevation of Privilege Security Boundary: User Summary: The standard user ContainerUser in a Windows Container has elevate...

Microsoft Windows Containers Privilege Escalation Vulnerability

The standard user ContainerUser in a Windows Container has elevated privileges and High integrity level which results in making it administrator equivalent even though it should be a restricted user. Windows Containers: ContainerUser has Elevated Privileges Windows Containers: ContainerUser has...

CVE-2020-13770

Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...