RogueWinRM

RogueWinRM RogueWinRM 是一个本地权限提升漏洞利用工具，允许从服务账户（具有 SeImpersonatePrivilege 权限）提升到本地系统账户，前提是 WinRM 服务未运行（Win10 默认未运行，但 Windows Server 2019 并非如此 ）。 简而言之，它会在 5985 端口监听传入连接，伪装成一个真正的 WinRM 服务。 它仅是一个最小的 Web 服务器，会尝试与任何试图连接该端口的服务协商 NTLM 身份验证。 然后，BITS 服务（以 Local System...

CVE-2020-1313

CVE-2020-1313 摘要 Windows 更新编排器服务（Windows Update Orchestrator Service）是一个 DCOM 服务，其他组件使用它来安装已下载的 Windows 更新。由于对调用者的授权不当，USO 存在权限提升漏洞（任意用户提升至本地系统）。该漏洞影响 Windows 10 和 Windows Server Core 产品。微软已在 2020 年 6 月补丁星期二中修复。 漏洞详情 UniversalOrchestrator 服务（9C695035-48D2-4229-8B73-4C70E756E519）在 usosvc.dll 中实现，以...

CVE-2019-9745

作者：Arn Vollebregt 引言 创造力是渗透测试的核心，这也让我们的工作充满趣味。然而，一个常见的陷阱是倾向于“过度设计”攻击场景，并只专注于 bug（错误条件）。而 flaws（非预期行为）同样可能存在，并带来同等严重的破坏性后果。本文通过一个案例研究来证明针对此类 flaws 进行渗透测试的重要性，同时也为采用 SDLC（安全开发生命周期）流程提供了有力论据。 本文是漏洞 CVE-2019-9745 的 负责任披露（RD）工作的一部分，并与厂商 CloudCTI 密切合作撰写。文章首先对漏洞进行高层概览，再深入技术细节。在演示漏洞利用之后，给出结论并总结了经验教训。 概要...

CVE-2020-11493

CVE-2020-11492 针对 Docker Desktop for Windows 权限提升漏洞的概念验证（PoC）。该漏洞已于 2020 年 5 月 11 日在 Docker 2.3.0.2 版本中得到修复。 此 PoC 执行以下操作： 创建一个模仿 Docker 命名管道 \.\pipe\dockerLifecycleServer 的命名管道， 在与 Docker 服务建立连接后调用 ImpersonateNamedPipeClient， 从当前线程中检索并复制模拟后的访问令牌， 使用该令牌启动一个新进程。新进程将以 SYSTEM 权限运行。 注意...

CVE-2022-26503

CVE-2022-26503 摘要： CVE-2022-26503 是 Veeam Agent for Microsoft Windows 中的一个漏洞，允许本地权限提升。成功利用此漏洞的攻击者可以以 LOCAL SYSTEM 权限运行任意代码。 感谢 @ultrayoba 补丁： 已实现的补丁显示了反序列化的痕迹： Veeam 官方知识库提到： Veeam Agent for Microsoft Windows 使用 Microsoft .NET 数据序列化机制。本地用户可以向 Veeam Agent for Windows Service 打开的端口（默认为 TCP...

CVE-2023-27532-RCE-Only

复刻版本（仅限 RCE） 已复刻该仓库并移除了凭据泄露部分。已应用编译修复。 CVE-2023-27532 用于利用 CVE-2023-27532 的概念验证代码，可泄露明文凭据或执行远程命令。 概述 有关漏洞及其利用的详细分析，请阅读 Rapid7 的 AttackerKB 分析。 编译 使用 Visual Studio 打开。由于 Liberis 的 Veeam.Backup.Common.dll、Veeam.Backup.Interaction.MountService.dll 和 Veeam.Backup.Model.dll 已包含在项目中，因此无需为此担心。 用法...

CVE-2026-10726

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726

The Cato Windows SDP Client before version 6.12.6 is vulnerable to an arbitrary file disclosure vulnerability. A low-privileged local user can exploit this flaw to force the Windows service—which operates with Local System privileges—to read and disclose arbitrary local files. The root cause is a...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-76967: Deserialization of Untrusted Data

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...

HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability may allow a local attacker to achieve escalation of privileges and/or arbitrary code execution through operating system command injection. This could lead to an attacker gaining unauthorized control over the...

dotnet: .NET Framework: Privilege escalation via code injection

A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected syste...

CVE-2026-15379

CVE-2026-15379 : The Altiris WMI provider exposes the AltirisAgent_Stream class, allowing any local standard user to read files accessible to the SYSTEM context, bypassing filesystem ACLs. The provider uses LocalSystem context for WMI queries without re-impersonating the caller, enabling read acc...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation pr...

CVE-2026-48725: Incorrect Default Permissions

Warp is an agentic development environment. From 0.2021.04.25.23.05.stable00 until 0.2026.05.06.15.42.stable01, Warp allows terminal output to request access to the local system clipboard. A malicious remote host, remote program, or other attacker-controlled terminal output source can trigger...

CVE-2020-37252

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with...

CVE-2023-54353

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files...

CVE-2020-37254

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot...

CVE-2020-37254

Wondershare PDFelement 5.2.9 is affected by a privilege escalation due to an unquoted service path in the WsAppService Windows service. Local attackers could place a malicious executable in the service path and gain code execution with LocalSystem privileges when the service restarts or the syste...