WPTaskScheduler_CVE-2024-49039

Persistenza di WPTaskScheduler e CVE-2024-49039, come una delle superfici di attacco all'interno di Task Scheduler. WPTaskScheduler.dll è un componente di Task Scheduler, a partire da Windows 10 1507. Probabilmente si tratta di uno strumento backdoor utilizzato per la persistenza, analizzato da...

SharpMove

SharpMove - Esecuzione autenticata .NET per host remoti Compilazione Per compilare, apri il progetto in Visual Studio e compila per il rilascio. Opzioni WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath root@kitploit:...

RedPersist

RedPersist RedPersist è uno strumento di persistenza per Windows scritto in C Compilazione del Progetto Di seguito sono elencate le librerie di terze parti utilizzate in questo progetto. TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Carica il progetto di...

wptsextensions.dll

WptsExtensions.dll per sfruttare il DLL Hijacking del Task Scheduler "non verrà corretto " Carica le variabili d'ambiente di Visual Studio x64: root@kitploit: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Aggiorna la variabile TCHAR script con un...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: विंडोज टास्क शेड्यूलर विशेषाधिकार वृद्धि भेद्यता अवलोकन CVE-2024-49039 एक विंडोज टास्क शेड्यूलर विशेषाधिकार वृद्धि EoP भेद्यता है जो एक प्रमाणित हमलावर को AppContainer सैंडबॉक्स से बचने की अनुमति देती है, Low integrity AppContainer से Medium integrity तक ऊपर उठाती है। CVSS स्कोर 8...

persistence-info.github.io

Il repository cerca di raccogliere informazioni sui meccanismi di persistenza di Windows per rendere più efficiente la protezione/rilevamento. La maggior parte delle informazioni è nota da anni e viene attivamente utilizzata in vari scenari. Aspettatevi altro. Faccio del mio meglio per aggiungere...

FullPowers

FullPowers FullPowers è uno strumento Proof-of-Concept che ho realizzato per recuperare automaticamente il set di privilegi predefinito di un account di servizio, inclusi SeAssignPrimaryToken e SeImpersonate. Motivazione Su Windows, alcuni servizi eseguiti come LOCAL SERVICE o NETWORK SERVICE son...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

EUVD-2026-45153

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

XXL-JOB 安全漏洞

XXL-JOB is a distributed task scheduling platform developed by xuxueli. Versions of XXL-JOB 3.3.2 and earlier contain security vulnerabilities. These vulnerabilities stem from improper control of resource identifiers due to the parameter logId in the function logDetailCat of the Execution Log...

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing By Prashanth A N and Mallikarjun Wali · April 20, 2026 PureRAT is an advanced remote access trojan RAT characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK fi...

MAL-2026-2884 Malicious code in forge-jsx (npm)

forge-jsx is a malicious npm package that impersonates an Autodesk Forge SDK. It was published as a fully-formed RAT from its first version on April 7, 2026. Installing the package on any non-CI machine deploys a persistent background agent that captures all keystrokes, monitors clipboard content...

CVE-2026-33619

PinchTab v0.8.3 exposes an unauthenticated blind SSRF via the scheduler’s webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the scheduler issues an outbound POST to that URL at terminal state. The webhook path only validated the URL scheme, failing...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the callbackUrl parameter in the Task Scheduler process. An attacker can cause the server to make arbitrary HTTP requests to external or internal systems by supplying a crafted URL. Remediation Upgra...

GO-2026-4825 PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl in github.com/pinchtab/pinchtab

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl in github.com/pinchtab/pinchtab...

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

Summary PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the v0.8.3 scheduler sends an outbound HTTP POST to that URL when the task reaches a terminal state. ...