juicy-potato

Juicy Potato злоупотребление золотыми привилегиями Подслащенная версияRottenPotatoNG с небольшим соком, т.е. еще один инструмент локального повышения привилегий от учётных записей служб Windows до NT AUTHORITY\SYSTEM Краткое описание RottenPotatoNG и его вариации используют цепочку повышения...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

CVE-2024-1403

CVE-2024-1403 Progress OpenEdge 認証バイパス Progress OpenEdge CVE-2024-1403 のエクスプロイト概念実証（PoC）です。 ブログ記事 詳細はこちら: https://www.horizon3.ai/attack-research/cve-2024-1403-progress-openedge-authentication-bypass-deep-dive 使用法 以下の jar ファイルのご自身のバージョンを用意する必要があります: progress.jar oeauth-12.8.-.jar osmetrics.jar...

CVE-2019-12889

CVE-2019-12889 요약 SailPoint Desktop Password Reset 7.2에는 인증되지 않은 권한 상승 취약점이 존재합니다. Windows 로그온 화면에만 로컬로 접근할 수 있는 사용자는 자신의 권한을 NT AUTHORITY\System으로 상승시킬 수 있습니다. 공격자는 성공적인 악용을 위해 머신에 대한 로컬 접근 권한이 필요합니다. 공격자는 컴퓨터를 로컬 네트워크/WAN에서 분리하고 인터넷에 연결된 액세스 포인트/네트워크에 연결해야 합니다. 그 시점에서 공격자는 비밀번호 재설정 기능을 실행할 수 있으...

CVE-2020-5752

CVE-2020-5752: Druva inSync ローカル特権昇格 Druva inSync Windows Client（v6.6.3以下）用のC言語ベースのエクスプロイトです。このアプリケーションはポート6064でRPCサービスを公開しており、パストラバーサルによるコマンドインジェクションに対して脆弱です。これにより、ローカルユーザーがNT AUTHORITY\SYSTEMとして任意のコマンドを実行できるようになります。 脆弱性の詳細 CVE: 2020-5752 テスト環境: Windows 10 x64 権限レベル: ローカル特権昇格 LPE 使用方法 1. コンパイル...

CVE-2026-57239

Foxit PDF Reader LPE Foxit PDF Readerのアップデーターサービスを介してNT AUTHORITY\SYSTEM権限を取得できる、CVE-2026-3775/CVE-2026-3780およびCVE-2026-57239の概念実証エクスプロイトです。 ビルド バイナリをビルドし、ターゲットに配置して実行するだけです。 root@kitploit: cargo build --release 使い方 このプログラムには3つの主要エントリーポイントがあります:...

EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-0299

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

EUVD-2026-57239

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...

PT-2026-71097

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITYSYSTEM...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

CVE-2026-13079

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and...

CVE-2026-13079

CVE-2026-13079 describes a local privilege escalation in the WatchGuard Mobile VPN with SSL client for Windows . The issue allows a local attacker to escalate to NT AUTHORITY\SYSTEM on the machine hosting the Windows client. Affected scope includes the Windows client versions up to and including ...

PT-2026-55325

Name of the Vulnerable Software and Affected Versions WatchGuard Mobile VPN with SSL client for Windows versions prior to 2026.3 Description A local privilege escalation issue allows an attacker with local access to the machine where the client is installed to elevate their privileges to NT...

EUVD-2026-28530

NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to improper privilege checks...

CVE-2026-8148

NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to improper privilege checks...

TRYHACKME_FLATLINE_REPORT

TryHackMe – Flatline CTF | Penetration Testing Report !Platf...

PT-2026-20800

An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT AuthoritySYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:ProgramDatawtaClientExe directory, which is writable by "Everyone". The executable...

Metasploit Wrap-Up 02/13/2026

SolarWinds Web Help Desk Our very own sfewer-r7 has developed an exploit module for the SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551. On successful exploitation the session will be as running as NT AUTHORITY\SYSTEM. For more information see the Rapid7’s SolarWinds We...