CVE-2019-1388-Privilege-Escalation--2021-

CVE-2019-1388 Privilegienausweitung CVE-2019-1388 Laboranalyse: Dokumentierte lokale Privilegienausweitung über Windows UAC-Zertifikatsdialoge unter Windows 7...

thm-ice-icecast-rce-privesc

TryHackMe — Ice: Icecast 2.0.1 RCE & Windows-Privilegieneskalation Plattform: TryHackMe Ziel-Betriebssystem: Windows 7 / Windows Server 2008 R2 Schwierigkeit: Einfach Kategorie: Buffer Overflow RCE, lokale Privilegieneskalation Zusammenfassung Dieser Bericht dokumentiert die vollständige...

TokenPlayer

TokenPlayer Manipolazione e abuso dei token di accesso di Windows. TokenPlayer è solo un piccolo strumento che ho realizzato per imparare la programmazione dell'API win32 e comprendere meglio il modello dei token di accesso di Windows. Caratteristiche: Rubare e impersonare i token primari...

blackhat-usa-2022-demos

blackhat-usa-2022-demos Demos para a palestra Blackhat USA 2022 "Taking Kerberos to the Next Level". Estes são os slides e demos da apresentação de James Forshaw @tiraniddo e Nick Landers @monoxgas. Os demos são os seguintes: demo1.ps1 - Silver ticket com senha. demo2.ps1 - Silver ticket U2U...

Elevator

Descrizione Elevator consente di bypassare l'UAC e generare un processo elevato con privilegi di amministratore completo. Ciò viene fatto abusando del comportamento del server RPC che implementa la funzionalità UAC, come dimostrato da James Forshaw nel suo articolo Calling Local Windows RPC Serve...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC su Windows 10/11 x64 utilizzando la chiave di registro DelegateExecute di ms-settings. Questo progetto di Visual Studio compilerà un binario statico x64 per testare questo problema. Licenza Questi file sono disponibili sotto la licenza BSD a 3 clausole...

PowerShell-for-Hackers

Hacker Hak5 dell'anno 2022 Indice 1. Descrizione 2. Le Funzioni 3. Contatti 4. Riconoscimenti Funzioni PowerShell per Hacker 🤓💻 Attualmente sono il contributore di payload numero 1 per Hak5. Ho deciso di creare questo repository per condividere tutte le funzioni che ho ideato per sviluppare i mie...

CompMgmtLauncher_DLL_UACBypass

CompMgmtLauncher & Sharepoint DLL Search Order Hijacking UAC/Persistenz über OneDrive CompMgmtLauncher.exe ist anfällig für eine DLL Search Order Hijacking-Schwachstelle. Die Binärdatei durchsucht bei installiertem OneDrive die Benutzerumgebung nach den DLLs Secur32.dll oder Wininet.dll. Auf...

CVE-2026-41451

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41449

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

EUVD-2026-64011

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh . Usernames and home directories read from /etc/passwd are substituted directly into command strings without escaping before execution via ...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

EUVD-2026-64010

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41450

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function. The root cause is that foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with e...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...