CVE-2024-1403

CVE-2024-1403 Progress OpenEdge 인증 우회 Progress OpenEdge CVE-2024-1403에 대한 익스플로잇 개념 증명 블로그 포스트 자세한 내용은 여기에서 확인하세요: https://www.horizon3.ai/attack-research/cve-2024-1403-progress-openedge-authentication-bypass-deep-dive 사용법 다음 jar 파일의 자체 버전을 제공해야 합니다: progress.jar oeauth-12.8.-.jar osmetrics.jar...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

juicy-potato

Juicy Potato 황금 권한 남용 RottenPotatoNG의 달콤한 버전으로, 약간의 주스가 첨가되었습니다. 즉, Windows 서비스 계정에서 NT AUTHORITY\SYSTEM으로의 또 다른 로컬 권한 상승 도구 입니다 요약 RottenPotatoNG 및 그 변종은 BITS 서비스가 127.0.0.1:6666에서 MiTM 리스너를 가지고 있고 SeImpersonate 또는 SeAssignPrimaryToken 권한이 있을 때의 권한 상승 체인을 활용합니다. Windows 빌드 검토 중에 BITS가 의도적으로 비활성화...

CVE-2019-12889

CVE-2019-12889 요약 SailPoint Desktop Password Reset 7.2에는 인증되지 않은 권한 상승 취약점이 존재합니다. Windows 로그온 화면에만 로컬로 접근할 수 있는 사용자는 자신의 권한을 NT AUTHORITY\System으로 상승시킬 수 있습니다. 공격자는 성공적인 악용을 위해 머신에 대한 로컬 접근 권한이 필요합니다. 공격자는 컴퓨터를 로컬 네트워크/WAN에서 분리하고 인터넷에 연결된 액세스 포인트/네트워크에 연결해야 합니다. 그 시점에서 공격자는 비밀번호 재설정 기능을 실행할 수 있으...

CVE-2026-57239

Foxit PDF Reader LPE 다음 취약점에 대한 개념 증명 익스플로잇입니다: CVE-2026-3775/CVE-2026-3780 및 CVE-2026-57239. Foxit PDF Reader 업데이터 서비스를 통해 NT AUTHORITY\SYSTEM 권한을 얻을 수 있습니다. 빌드 바이너리를 빌드한 후 타겟에 복사하고 실행하기만 하면 됩니다. cargo build --release 사용법 프로그램에는 세 가지 주요 진입점이 있습니다: check, exploit, cleanup. 인수가 수행하는 작업은 상당히 명확합니다...

CVE-2020-5752

CVE-2020-5752: Druva inSync 로컬 권한 상승 Druva inSync Windows 클라이언트v6.6.3 이하용 C 기반 익스플로잇입니다. 애플리케이션은 포트 6064에서 RPC 서비스를 노출하며, 경로 탐색을 통한 명령 주입 취약점이 있습니다. 이를 통해 로컬 사용자는 NT AUTHORITY\SYSTEM 권한으로 임의의 명령을 실행할 수 있습니다. 취약점 세부 정보 CVE: 2020-5752 테스트 환경: Windows 10 x64 권한 수준: 로컬 권한 상승LPE 사용법 1. 컴파일 gccMinGW를...

CVE-2026-92369

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

CVE-2026-92369

TeamViewer Full Client and Host on Windows prior to version 15.82 are vulnerable to a TOCTOU race condition within the installer rollback mechanism. A local low-privileged attacker can exploit this by replacing rollback backup files in a user-writable temporary directory before an elevated instal...

CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

PT-2026-102662

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the installer rollback mechanism on Windows. This occurs when a local low-privileged attacker replaces rollback...

CVE-2026-92369: Time-of-check Time-of-use (TOCTOU) Race Condition

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

PT-2026-102646

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description Improper path validation in the local IPC Inter-Process Communication service allows a local authenticated user with low privileges to perform arbitrary file writes with...

Input Leap Arbitrary Command Execution

Missing authentication for a critical function in the input-leapd daemon of Input Leap, the open-source keyboard and mouse sharing tool, allows a local, low-privileged user on Windows to execute arbitrary commands as NT AUTHORITY\SYSTEM by sending a single IPC command message to the daemon's...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153: Improper Privilege Management

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-76159

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

EUVD-2026-78330

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

CVE-2026-76159 Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...