RedPersist

RedPersist RedPersist は C で書かれた Windows 永続化ツールです。 プロジェクトのコンパイル このプロジェクトでは以下のサードパーティライブラリを使用しています。 TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Visual Studio プロジェクトを開き、「ツール」「NuGet パッケージ マネージャー」「パッケージ マネージャー設定」に移動します。 「NuGet パッケージ マネージャー」「パッケージ ソース」を開きます。...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath root@kitploit: SharpMove.exe action=que...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler 持久化与 CVE-2024-49039：任务计划程序中的一个攻击面 WPTaskScheduler.dll 是任务计划程序的一个组件，自 Windows 10 1507 版本起存在。 这很可能是一个用于持久化的后门工具，经安全研究人员分析， 发现它能够绕过受限令牌沙箱、子进程限制，并提升至中等完整性。 ??? 1: 建立 RPC 连接，但受限令牌（如 Google Chrome 渲染器进程）似乎无法建立 RPC 连接， 因此它可能没什么用？不过 audio.mojom.AudioService 和 gpu-process 的绕过成功了…… 2: 似乎...

wptsextensions.dll

用于利用任务计划程序 DLL 劫持的 WptsExtensions.dll（"不会修复 "） 加载 x64 Visual Studio 环境变量： root@kitploit: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" 将 TCHAR script 变量更新为一个可写的 SYSTEM 路径，DLL 将在此路径中被查找。 可查看此工具来查找这类路径。 你也可以通过以下命令列出此环境变量： powershell -c...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: Windows 任务计划程序特权提升漏洞 概述 CVE-2024-49039 是一个 Windows 任务计划程序特权提升（EoP）漏洞，允许经过身份验证的攻击者逃离 AppContainer 沙箱，从低完整性（AppContainer）提升至中完整性。该漏洞的 CVSS 评分为 8.8，已被 RomCom 威胁组在野外积极利用。 CVE ID : CVE-2024-49039 CVSS 评分 : 8.8（高） CWE : CWE-287（认证不当） 发现者 : Google 威胁分析组（TAG） 利用者 : RomCom 组 影响 :...

persistence-info.github.io

该仓库旨在收集有关 Windows 持久化机制的信息，以使防护/检测更加高效。其中大部分信息多年来已广为人知，并在各种场景中被积极使用。 敬请期待更多。我会尽最大努力每天添加新条目。 工作原理及如何参与贡献。 👨‍💼 HKCU 的 Run 和 RunOnce 注册表项 👨‍💼 ⚙ 任务计划程序 ⚙ 映像文件执行选项注册表项 ⚙ Windows 服务 AeDebug WER 调试器 ⚙ 自然语言开发平台 6 的 DLL ⚙ GPO 客户端扩展 ⚙ 用于 Windows 搜索的筛选处理程序 磁盘清理处理程序 👨‍💼 .chm 辅助 DLL hhctrl.ocx ⚙ AMSI 提供程序 ⚙...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

CVE-2026-72945

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

EUVD-2026-73113

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

CVE-2026-72945

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler , caused by the use of an uninitialized resource . An authorized local attacker with low privileges can exploit this to disclose information, with high confidentiality impact and no integrity or availability impac...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

EUVD-2026-45153

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

XXL-JOB 安全漏洞

XXL-JOB is a distributed task scheduling platform developed by xuxueli. Versions of XXL-JOB 3.3.2 and earlier contain security vulnerabilities. These vulnerabilities stem from improper control of resource identifiers due to the parameter logId in the function logDetailCat of the Execution Log...

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing By Prashanth A N and Mallikarjun Wali · April 20, 2026 PureRAT is an advanced remote access trojan RAT characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK fi...

MAL-2026-2884 Malicious code in forge-jsx (npm)

forge-jsx is a malicious npm package that impersonates an Autodesk Forge SDK. It was published as a fully-formed RAT from its first version on April 7, 2026. Installing the package on any non-CI machine deploys a persistent background agent that captures all keystrokes, monitors clipboard content...

CVE-2026-33619

PinchTab v0.8.3 exposes an unauthenticated blind SSRF via the scheduler’s webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the scheduler issues an outbound POST to that URL at terminal state. The webhook path only validated the URL scheme, failing...