AddUser-SAMR

AddUser-SAMR 使用 SAMR API 创建本地管理员，其操作层级低于 net.exe、PowerShell 的 New-LocalUser 或 NetUserAdd API。 需要管理员权限，如果用户已存在，则将其添加到组中，但不会更新密码。 本仓库提供 4 种实现（C、Python、Rust 和 Crystal），但其他语言也有公开版本，例如 @M0nster3 的 C++ 或 @AgeloVito 的 BOF 文件。 此代码是 这篇博客文章 的补充，该文章介绍了创建本地帐户的不同技术。 用法 参数如下： -u, --username - 要创建的用户名（必填） -p,...

PT-2026-90263

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svc create initializes three per-pool percpu counter stats and ignores every return value. On SMP, percpu counter init fails when alloc percpu gfp cannot satisfy the allocation,...

PT-2026-90377

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock filesystem Writing a filesystem path to /proc/fs/nfsd/unlock filesystem runs nfsd4 cancel copy by sb before nfsd mutex is held and before the handler confirms that nn-nfsd serv...

CVE-2026-24291

CVE-2026-24291 Versión ofuscada de RegPwn https://www.mdsec.co.uk/2026/03/rip-regpwn/ Se añadió funcionalidad adicional que creará automáticamente un administrador local con credenciales generadas. Puedes recompilar el payload con ejecución de código como administrador según lo desees. Pasos -...

CVE-2025-66680

CVE-2025-66680 En Wise Force Deleter 1.5.7.59 y versiones anteriores, un atacante con acceso de administrador local puede eliminar archivos arbitrarios del sistema de archivos al convertir la aplicación en un arma. Uso 1. Coloque WiseDelfile64.sys en C:\Windows 2. Compile el proyecto 3. Cree...

EUVD-2026-66834

“unsupported-when-assigned.” An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash BSOD or BIOS corruption via a crafted software SMI SW SMI request with an oversized length value.Refer to the ' Security Update for...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5 . The flaw resides in the external PDF viewer used to display the application manual and its interaction with the underlying Windows operating system . An...

CVE-2026-72468 xprtrdma: Initialize re_id before removal registration

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-0292

This CVE (CVE-2026-0292) involves an authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent. The vulnerability allows a local administrator to bypass security inspection and inject/intercept arbitrary traffic. Affected: Prisma Access Agent on Windows; Linux/...

CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...

CVE-2026-47876

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...

CVE-2026-47876

CVE-2026-47876 is an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter of VMware ESX/ESXi. A local administrator inside a VM using VMXNET3 can potentially execute code on the ESX host; non-VMXNET3 adapters are not affected. Connected documents confirm patches/updates have b...

CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...

PT-2026-65833

Name of the Vulnerable Software and Affected Versions VMware vCenter versions prior to 9.1.0.0300 VMware vCenter versions prior to 9.0.2.0100 VMware vCenter versions prior to 8.0 U3k VMware vCenter versions prior to 8.0 U2f Description VMware vCenter contains a directory traversal flaw in the...

CVE-2026-41993

Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy...

CVE-2026-41993

Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy...

CVE-2026-41993

Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy...

CVE-2026-40953 Heap overflow in Secure Access clients

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control...

CVE-2026-15030

Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security...

CVE-2026-13585

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe...