wptsextensions.dll

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking "won't fix " Load x64 visual studio environnement variables: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Update the TCHAR script variable with a writable SYSTEM path where the DLL will...

RedPersist

RedPersist RedPersist is a Windows Persistence tool written in C Compiling Project Below 3rd party libraries are used in this project. TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Load the Visual Studio project up and go to "Tools" "NuGet Package Manager...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath SharpMove.exe action=query...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability Overview CVE-2024-49039 is a Windows Task Scheduler Elevation of Privilege EoP vulnerability that allows an authenticated attacker to escape the AppContainer sandbox, elevating from Low integrity AppContainer to Medium...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

CVE-2026-96845

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-96053

Improper neutralization of special elements used in a command 'command injection' in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-95894

Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-88233

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-122174

Improper link resolution before file access 'link following' in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-112759

Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-122174

A local privilege escalation vulnerability exists in Windows Task Scheduler due to improper link resolution before file access (link following). An authorized attacker can exploit this flaw to elevate privileges. While the provided documents do not specify a precise exploit path, the vulnerabilit...

EUVD-2026-122497

Improper link resolution before file access 'link following' in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

EUVD-2026-122068

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-96845

A security vulnerability exists in Windows Task Scheduler due to improper authorization , which allows an authorized attacker to achieve local privilege escalation . While the specific technical root cause is not detailed in the provided documents, the impact involves an authorized user gaining e...

EUVD-2026-121854

Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally...

CVE-2026-112759

A heap-based buffer overflow in the Windows Task Scheduler component allows an authorized attacker to achieve local privilege escalation . The vulnerability is addressed in various cumulative security updates, including KB5131291 (for Windows Server 2016 and Windows 10 version 1607), KB5131085 (f...

CVE-2026-96053

CVE-2026-96053 involves an improper neutralization of special elements used in a command (command injection ) within Windows Task Scheduler . This vulnerability allows an authorized attacker to elevate privileges locally . While the provided documents confirm the existence of the vulnerability an...