CVE-2020-11493

CVE-2020-11492 Prueba de concepto PoC para la vulnerabilidad de escalada de privilegios de Docker Desktop para Windows. Esta vulnerabilidad fue parcheada en la versión 2.3.0.2 de Docker el 11 de mayo de 2020. Este PoC realiza lo siguiente: crea una tubería con nombre named pipe que imita la tuber...

CVE-2019-9745

作者：Arn Vollebregt 引言 创造力是渗透测试的核心，这也让我们的工作充满趣味。然而，一个常见的陷阱是倾向于“过度设计”攻击场景，并只专注于 bug（错误条件）。而 flaws（非预期行为）同样可能存在，并带来同等严重的破坏性后果。本文通过一个案例研究来证明针对此类 flaws 进行渗透测试的重要性，同时也为采用 SDLC（安全开发生命周期）流程提供了有力论据。 本文是漏洞 CVE-2019-9745 的 负责任披露（RD）工作的一部分，并与厂商 CloudCTI 密切合作撰写。文章首先对漏洞进行高层概览，再深入技术细节。在演示漏洞利用之后，给出结论并总结了经验教训。 概要...

CVE-2020-1313

CVE-2020-1313 摘要 Windows 更新编排器服务（Windows Update Orchestrator Service）是一个 DCOM 服务，其他组件使用它来安装已下载的 Windows 更新。由于对调用者的授权不当，USO 存在权限提升漏洞（任意用户提升至本地系统）。该漏洞影响 Windows 10 和 Windows Server Core 产品。微软已在 2020 年 6 月补丁星期二中修复。 漏洞详情 UniversalOrchestrator 服务（9C695035-48D2-4229-8B73-4C70E756E519）在 usosvc.dll 中实现，以...

CVE-2022-26503

CVE-2022-26503 摘要： CVE-2022-26503 是 Veeam Agent for Microsoft Windows 中的一个漏洞，允许本地权限提升。成功利用此漏洞的攻击者可以以 LOCAL SYSTEM 权限运行任意代码。 感谢 @ultrayoba 补丁： 已实现的补丁显示了反序列化的痕迹： Veeam 官方知识库提到： Veeam Agent for Microsoft Windows 使用 Microsoft .NET 数据序列化机制。本地用户可以向 Veeam Agent for Windows Service 打开的端口（默认为 TCP...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

CVE-2023-27532-RCE-Only

复刻版本（仅限 RCE） 已复刻该仓库并移除了凭据泄露部分。已应用编译修复。 CVE-2023-27532 用于利用 CVE-2023-27532 的概念验证代码，可泄露明文凭据或执行远程命令。 概述 有关漏洞及其利用的详细分析，请阅读 Rapid7 的 AttackerKB 分析。 编译 使用 Visual Studio 打开。由于 Liberis 的 Veeam.Backup.Common.dll、Veeam.Backup.Interaction.MountService.dll 和 Veeam.Backup.Model.dll 已包含在项目中，因此无需为此担心。 用法...

HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability may allow a local attacker to achieve escalation of privileges and/or arbitrary code execution through operating system command injection. This could lead to an attacker gaining unauthorized control over the...

dotnet: .NET Framework: Privilege escalation via code injection

A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected syste...

CVE-2026-15379

CVE-2026-15379 : The Altiris WMI provider exposes the AltirisAgent_Stream class, allowing any local standard user to read files accessible to the SYSTEM context, bypassing filesystem ACLs. The provider uses LocalSystem context for WMI queries without re-impersonating the caller, enabling read acc...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation pr...

CVE-2020-37252

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with...

CVE-2023-54353

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files...

CVE-2020-37254

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

CVE-2020-37254

Wondershare PDFelement 5.2.9 is affected by a privilege escalation due to an unquoted service path in the WsAppService Windows service. Local attackers could place a malicious executable in the service path and gain code execution with LocalSystem privileges when the service restarts or the syste...

CVE-2020-37254 Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

EUVD-2020-31252

RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute arbitrary code with LocalSystem privileges during service...

CVE-2020-37252 Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with...

CVE-2020-37252

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with...

CVE-2020-37252

CVE-2020-37252 describes an unquoted service path vulnerability in Realtek Audio Service 1.0.0.55, specifically in RtkAudioService64.exe. The root cause is the unquoted service path, enabling local attackers to escalate privileges by placing a malicious executable in the unquoted directory, which...

CVE-2020-37250

TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during servi...