CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumera las entradas CLSID y AppID del registro de Windows para identificar objetos COM asociados con servicios de Windows a través del valor LocalService. La función correlaciona estas entradas, exporta los resultados a un archivo CSV e intenta la activación COM...

TChopper

TChopper Nueva técnica que he descubierto recientemente y le he dado un apodo Chop chop para realizar movimiento lateral utilizando el nombre para mostrar de servicios de Windows y WMI, contrabandeando el binario malicioso como fragmentos base64 y automatizando el proceso con la herramienta...

smbtakeover

smbtakeover A technique to unbind and rebind 445/tcp on Windows without loading a driver, loading a module into LSASS, or rebooting the target machine. Implemented to ease the burden of SMB-based NTLM relays while operating over C2. Technical analysis of the technique is dicussed in more detail...

Hijack-service-binaries

Hijack-service-binaries A PowerShell security auditing tool that identifies Windows service binaries that can be modified by the current user—a potential privilege escalation vector. Overview This script scans all Windows services except system32 and svchost and checks if the current user has...

ACEshark

ACEshark What is it? ACEshark is a utility designed for rapid extraction and analysis of Windows service configurations and Access Control Entries, eliminating the need for tools like accesschk.exe or other non-native binaries. Why? Efficiently identify and analyze service permissions to uncover...

presentations

My presentations More things can be found in my personal site: https://sites.google.com/site/zhiniangpeng Exploiting preauth RCE and Sandbox escape vulnerabilities in EXSi, Typhooncon 2023 OLE object are still dangerous today — Exploiting Microsoft Office, POC 2023 Django-Simple-Captcha —...

CVE-2026-69595: Use After Free

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-78445: Use After Free

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-73024: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-70585: Use After Free

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally...

CVE-2026-83989: Out-of-bounds Read

Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network...

CVE-2026-71330: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network...

EUVD-2026-15192

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-33253

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-33253

SANUPS SOFTWARE (SANYO DENKI CO., LTD.) exposes a Windows service registration with an unquoted executable path. According to the description, a user with write access to the system drive root can trigger arbitrary code execution with SYSTEM privileges via a local privilege escalation. The connec...

CVE-2026-33253

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

Serviio PRO 代码问题漏洞

Serviio PRO is a multimedia streaming server software developed by the British company Serviio. Version 1.8 of Serviio PRO contains a code vulnerability. This vulnerability stems from improper search paths and directory permissions in Windows services, which may allow local users to execute...

Canon IJ Scan Utility registers Windows services with unquoted file paths

Overview IJ Scan Utility provided by Canon Inc. contains the following vulnerability. Unquoted search path or element CWE-428 - CVE-2026-1585 Canon Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may execute arbitrary code with SYSTEM...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...