SharpMove

SharpMove - аутентифицированное выполнение .NET на удаленных хостах Сборка Чтобы скомпилировать, откройте проект в Visual Studio и соберите его для релиза. Опции WMI SCM DCOM несколько Планировщик задач Угон DLL службы Угон сервера DCOM Изменение запланированной задачи Изменение binpath службы...

RedPersist

RedPersist RedPersist — это инструмент для обеспечения персистентности в Windows, написанный на C Компиляция проекта Ниже приведены сторонние библиотеки, используемые в этом проекте. TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Загрузите проект Visual...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence и CVE-2024-49039 как часть поверхности атаки в Планировщике задач. WPTaskScheduler.dll является компонентом Планировщика задач, начиная с Windows 10 1507. Это, вероятно, инструмент-бэкдор, используемый для персистентности, который был проанализирован исследователями...

wptsextensions.dll

작업 스케줄러 DLL 하이재킹 악용을 위한 WptsExtensions.dll "수정 안 됨" x64 Visual Studio 환경 변수 로드: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" TCHAR script 변수를 DLL이 검색될 쓰기 가능한 SYSTEM 경로로 업데이트하세요. 이 도구를 확인하여 그러한 경로들을 찾으세요. 다음 명령으로 이 환경 변수를 나열할 수도 있습니다: powershell -c...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: Windows 작업 스케줄러 권한 상승 취약점 개요 CVE-2024-49039는 인증된 공격자가 AppContainer 샌드박스를 탈출하여 Low 무결성AppContainer에서 Medium 무결성으로 권한을 상승시킬 수 있게 하는 Windows 작업 스케줄러 권한 상승EoP 취약점입니다. 이 취약점은 CVSS 점수 8.8을 부여받았으며, RomCom 위협 그룹에 의해 실제 환경에서 활발히 악용되었습니다. CVE ID : CVE-2024-49039 CVSS 점수 : 8.8 높음 CWE : CWE-2...

persistence-info.github.io

이 저장소는 보호/탐지를 더 효율적으로 만들기 위해 Windows 지속성 메커니즘에 대한 정보를 수집하려고 합니다. 대부분의 정보는 수년간 잘 알려져 있으며 다양한 시나리오에서 활발히 사용되고 있습니다. 더 많은 것이 준비되어 있습니다. 매일 새 항목을 추가하기 위해 최선을 다하고 있습니다. 작동 방식. 그리고 기여 방법. 👨‍💼 HKCU Run 및 RunOnce 레지스트리 키 👨‍💼 ⚙ 작업 스케줄러 ⚙ 이미지 파일 실행 옵션 키 ⚙ Windows 서비스 AeDebug WER 디버거 ⚙ Natural Language...

FullPowers

FullPowers FullPowers — это инструмент Proof-of-Concept, созданный мной для автоматического восстановления набора привилегий по умолчанию учётной записи службы, включая SeAssignPrimaryToken и SeImpersonate. Обоснование В Windows некоторые службы, выполняемые от имени LOCAL SERVICE или NETWORK...

CVE-2026-72945

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

CVE-2026-72945

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler , caused by the use of an uninitialized resource . An authorized local attacker with low privileges can exploit this to disclose information, with high confidentiality impact and no integrity or availability impac...

EUVD-2026-73113

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

Windows Task Scheduler Information Disclosure Vulnerability

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

PT-2026-87862

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

CVE-2026-72945: Use of Uninitialized Resource

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

Exploit for Improper Authentication in Microsoft

CVE-2024-49039: Windows Task Scheduler Elevation of Privilege...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

EUVD-2026-45153

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...