KRBUACBypass

Background This POC is inspired by James Forshaw @tiraniddo shared at BlackHat USA 2022 titled “ Taking Kerberos To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake...

cve-2021-34527

CVE-2021-34527 CVE-2021-34527 LPE exploit using AddPrinterDriverEx - this is a weaponized version of the LPE that can be used to escalate a DLL to SYSTEM and will also clean up artifacts. The LPE impacts Windows Desktop 7,8,8.1,10,11 & Server 2008,2012,2016,2019. This visual studio project will...

CVE-2024-38143

CVE-2024-38143 Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability Successful exploitation can lead to possible escalation to NT AUTHORITY\SYSTEM Background While on a client engagement, I had to test a physical laptop and for some reason, stumbled upon this article by Matthew...

CVE-2018-19320-LPE

CVE-2018-19320 LPE Exploit Descripción Explotación de escalada de privilegios local de CVE-2018-19320. El exploit utiliza las funciones expuestas en gdrv.sys que permiten a un usuario de bajo nivel asignar y escribir datos en la memoria para escalar los privilegios a SYSTEM. Captura de pantalla...

honda

RoguePlanet（Nightmare-Eclipse 作） HONDA（nu11secur1ty 作） RoguePlanet Windows Defender の脆弱性 著者: オリジナルエクスプロイト開発者 Nightmare-Eclipse 開発、テスト、および兵器化 nu11secur1ty （ペネトレーションテスティングエンジニア） 🧠 nu11secur1ty による技術的分析 このエクスプロイトは、Windows Defender のクリーンアップルーチン（MpCleanCallbackFunction）と Volume Shadow Copy...

ZygoteExploitDemo

🔥 ZygoteExploitDemo - CVE-2024-31317 Android Security Lab 🚨 Educational Demonstration of Android Zygote Injection Vulnerability 📋 Overview This lab demonstrates CVE-2024-31317 , a critical Android vulnerability that allows a malicious app to escalate privileges to SYSTEM level UID 1000 and bypass...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE Arbitrary File Delete to SYSTEM. Majority of code is based on the referenced PoC by @filipdragovic. Thanks @filipdragovic & @k0zmer : Blog Post: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lpe References...

CVE-2024-0670

CVE-2024-0670 – Escalada de privilegios local en el agente CheckMK PoC en PowerShell Resumen Este repositorio presenta una prueba de concepto independiente en PowerShell para CVE-2024-0670 , una vulnerabilidad de escalada de privilegios local en Windows en el agente CheckMK. La vulnerabilidad...

EUVD-2026-52326

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-14961

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-14961

CVE-2026-14961 affects Pegatron tdeio64.sys exposing the .�5cTdeIo device. The IOCTL dispatch lacks privilege validation and does not validate user-supplied kernel addresses, allowing arbitrary kernel memory read/write and privilege escalation to NT AUTHORITY\SYSTEM. The linked explainer also not...

EUVD-2026-44731

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-57239

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM...

CVE-2026-57919

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe \.\pipe\PBackupVSS with a DACL that grants GENERICREAD and GENERICWRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigge...

KB5094042: Windows Server 2012 Security Update (June 2026)

The remote Windows host is missing security update 5094042. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

CVE-2026-0539

Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM privileges on boot. This issue affects all...

PT-2026-45256

In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786...

Ivanti Secure Access Client 22.x < 22.8R6 Multiple Vulnerabilities

The Ivanti Secure Access Client installed on the remote host is 22.x prior to 22.8R6. It is, therefore, affected by multiple vulnerabilities: - An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify...

EUVD-2020-31224

IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files x86\IObit directory and restart the service t...