cve-2021-34527

CVE-2021-34527 Exploit de LPE para CVE-2021-34527 mediante AddPrinterDriverEx - esta es una versión armada del LPE que puede emplearse para escalar una DLL a SYSTEM y que también limpiará los artefactos. El LPE afecta a Windows Desktop 7,8,8.1,10,11 y Server 2008,2012,2016,2019. Este proyecto de...

CVE-2018-19320-LPE

CVE-2018-19320 LPE Exploit Descripción Explotación de escalada de privilegios local de CVE-2018-19320. El exploit utiliza las funciones expuestas en gdrv.sys que permiten a un usuario de bajo nivel asignar y escribir datos en la memoria para escalar los privilegios a SYSTEM. Captura de pantalla...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE Eliminación arbitraria de archivos a SYSTEM. La mayor parte del código se basa en el PoC de referencia de @filipdragovic. Gracias @filipdragovic & @k0zmer : Publicación del blog: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lpe...

KRBUACBypass

背景 本 POC 的灵感来源于 James Forshaw（@tiraniddo）在 BlackHat USA 2022 上分享的题为"Taking Kerberos To The Next Level"的主题演讲，他演示了通过滥用 Kerberos 票据实现 UAC 绕过。通过在服务票据中添加一个 KERB-AD-RESTRICTION-ENTRY，但填入伪造的 MachineID，我们可以轻松绕过 UAC，并通过访问 SCM 创建系统服务来获得 SYSTEM 权限。James Forshaw 在一篇名为 "Bypassing UAC in the most Complex Way...

ZygoteExploitDemo

🔥 ZygoteExploitDemo - CVE-2024-31317 Android 安全实验室 🚨 Android Zygote 注入漏洞的教育演示 📋 概述 本实验室演示了 CVE-2024-31317 ，这是一个严重的 Android 漏洞，允许恶意应用将权限提升至 SYSTEM 级别 UID 1000 ，并绕过 Android 沙箱实时读取其他应用的数据。 🎯 本演示展示的内容 阶段| 描述| 图示 ---|---|--- 1| 用户安装看似无害的“Flashlight Pro”应用| 🔦 2| 应用利用 CVE-2024-31317 获取 SYSTEM 访问权限| 💉 3|...

CVE-2024-0670

CVE-2024-0670 – Escalada de privilegios local en el agente CheckMK PoC en PowerShell Resumen Este repositorio presenta una prueba de concepto independiente en PowerShell para CVE-2024-0670 , una vulnerabilidad de escalada de privilegios local en Windows en el agente CheckMK. La vulnerabilidad...

CVE-2024-38143

CVE-2024-38143 Vulnerabilidad de Elevación de Privilegios en el Servicio de Configuración Automática de WLAN de Windows La explotación exitosa puede llevar a una posible escalación a NT AUTHORITY\SYSTEM Antecedentes Durante un compromiso con un cliente, tuve que probar una computadora portátil...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty Vulnerabilidad de Windows Defender de RoguePlanet Autores: Desarrollador original del exploit Nightmare-Eclipse Desarrollo, pruebas y weaponización nu11secur1ty Ingeniero de Pruebas de Penetración 🧠 Análisis Técnico por nu11secur1ty El exploi...

EUVD-2026-52326

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

CVE-2026-14961

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-14961

The Pegatron tdeio64.sys driver, a Windows Driver Model (WDM) component, contains a privilege escalation vulnerability (CVE-2026-14961) due to an unprotected IOCTL dispatch routine on the \. hetdeIo device interface. The driver fails to validate caller privileges or verify user-supplied memory ad...

EUVD-2026-44731

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

PT-2026-60232

Pegatron Tdelo64.sys exposes a privileged device interface, .TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

PT-2026-57207

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the processes table targeting a maliciously crafted process, due to uncheck...

CVE-2026-57239

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM...

CVE-2026-57919

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe \.\pipe\PBackupVSS with a DACL that grants GENERICREAD and GENERICWRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigge...

KB5094042: Windows Server 2012 Security Update (June 2026)

The remote Windows host is missing security update 5094042. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

CVE-2026-0539

Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM privileges on boot. This issue affects all...

PT-2026-45256

In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786...