CVE-2018-19320-LPE

Exploit de LPE CVE-2018-19320 Descrição Exploit de escalação de privilégio local da CVE-2018-19320. O exploit usa as funções expostas em gdrv.sys que permitem que um usuário de baixo nível aloque e grave dados na memória para elevar os privilégios a SYSTEM. Captura de Tela Testado em: Windows 10...

cve-2021-34527

CVE-2021-34527 CVE-2021-34527 exploit LPE utilizzando AddPrinterDriverEx - questa è una versione armata dell'LPE che può essere usata per elevare una DLL a SYSTEM e pulirà anche gli artefatti. L'LPE impatta Windows Desktop 7,8,8.1,10,11 e Server 2008,2012,2016,2019. Questo progetto Visual Studio...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE Beliebige Dateilöschung zu SYSTEM. Der Großteil des Codes basiert auf dem referenzierten PoC von @filipdragovic. Danke @filipdragovic & @k0zmer : Blogbeitrag: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lpe Referenzen...

CVE-2024-38143

CVE-2024-38143 Vulnerabilidade de Elevação de Privilégio no Serviço AutoConfig de WLAN do Windows A exploração bem-sucedida pode levar a uma possível escalada para NT AUTHORITY\SYSTEM Histórico Durante um trabalho com um cliente, precisei testar um laptop físico e, por algum motivo, deparei-me co...

KRBUACBypass

Contesto Questo POC è ispirato da James Forshaw @tiraniddo condiviso al BlackHat USA 2022 intitolato “ Taking Kerberos To The Next Level ”, ha condiviso una demo dell'abuso dei ticket Kerberos per ottenere un bypass UAC. Aggiungendo un KERB-AD-RESTRICTION-ENTRY al ticket di servizio, ma inserendo...

honda

RoguePlanet di Nightmare-Eclipse HONDA di nu11secur1ty Vulnerabilità di Windows Defender in RoguePlanet Autori: Sviluppatore originale dell'exploit Nightmare-Eclipse Sviluppo, test e weaponizzazione nu11secur1ty Ingegnere di Penetration Testing 🧠 Analisi Tecnica di nu11secur1ty L'exploit sfrutta...

CVE-2024-0670

CVE-2024-0670 – Lokale Privilegienausweitung im CheckMK Agent PowerShell PoC Zusammenfassung Dieses Repository präsentiert einen unabhängigen PowerShell-Proof-of-Concept für CVE-2024-0670 , eine Windows-Schwachstelle zur lokalen Privilegienausweitung im CheckMK Agent. Die Schwachstelle ermöglicht...

ZygoteExploitDemo

🔥 ZygoteExploitDemo - CVE-2024-31317 Android Sicherheitslabor 🚨 Pädagogische Demonstration der Android Zygote Injection Schwachstelle 📋 Übersicht Dieses Labor demonstriert CVE-2024-31317 , eine kritische Android-Sicherheitslücke, die es einer bösartigen App ermöglicht, Privilegien auf SYSTEM-Eben...

EUVD-2026-52326

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-14961

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-14961

CVE-2026-14961 affects Pegatron tdeio64.sys exposing the .�5cTdeIo device. The IOCTL dispatch lacks privilege validation and does not validate user-supplied kernel addresses, allowing arbitrary kernel memory read/write and privilege escalation to NT AUTHORITY\SYSTEM. The linked explainer also not...

EUVD-2026-44731

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-57239

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM...

CVE-2026-57919

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe \.\pipe\PBackupVSS with a DACL that grants GENERICREAD and GENERICWRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigge...

KB5094042: Windows Server 2012 Security Update (June 2026)

The remote Windows host is missing security update 5094042. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

CVE-2026-0539

Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM privileges on boot. This issue affects all...

PT-2026-45256

In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786...

Ivanti Secure Access Client 22.x < 22.8R6 Multiple Vulnerabilities

The Ivanti Secure Access Client installed on the remote host is 22.x prior to 22.8R6. It is, therefore, affected by multiple vulnerabilities: - An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify...

EUVD-2020-31224

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files x86\IObit directory and restart the service t...