ResetNightmare is an authorization flaw in the Microsoft Kerberos Change Password protocol. On an unpatched domain controller, an attacker who can write the userPrincipalName attribute of a controlled account can obtain a kadmin/changepw ticket whose client name identifies another account while its PAC identifies the controlled account. The module temporarily changes the controlled account's UPN to the target sAMAccountName, requests a kadmin/changepw ticket with an NT-ENTERPRISE client name, restores the original UPN, and uses the ticket in an RFC 3244 password-change exchange. The target credentials are verified and stored as an Impact identity by default. The controlled account can be an existing user or computer whose cleartext password is known and whose userPrincipalName can be modified.

This module exploits CVE-2026-53365, to elevate privileges on a Linux target. The vulnerability is a page-reference-count underflow in the Linux kernel io_uring zero-copy send path over AF_VSOCK. It can free a page that remains pinned and allow the page to be reclaimed as privileged file page-cache data. The exploit uses the vulnerability to modify the interpreter path in the page-cache contents of "/usr/bin/su" and execute a caller-supplied ELF with root privileges. The module uploads the exploit binary and a generated Core Impact agent ELF with random names to the directory selected by the TMP_DIR parameter. After successful exploitation, its setuid helper executes that agent with root privileges. Before exploitation, the module refuses to continue if the cached "/usr/bin/su" image already references the exploit interpreter and removes stale files from previous failed attempts. After the privileged interpreter has executed, the exploit restores the original cached "/usr/bin/su" ELF page through its fixed-buffer alias before tearing down the io_uring worker. After the new agent connects, the module waits for a privileged filesystem-cache eviction, verifies that the cached "/usr/bin/su" image no longer references the exploit interpreter, and removes the uploaded files and fixed-name exploit artifacts. Even after successful restoration, another exploitation attempt requires a reboot because the affected page and allocator state are not reusable during the same boot.

This module exploits CVE-2026-66804, an improper access control vulnerability in the Microsoft Windows Cross Device Service, to execute a CORE Impact agent with NT AUTHORITY\SYSTEM privileges. Windows registers the Cross Device virtual-camera COM server at PROGRAMDATA\CrossDevice\CrossDevice.Streaming.Source.dll. On affected systems, the machine-wide registration can exist while PROGRAMDATA\CrossDevice is absent and creatable by a standard user. An attacker can create that missing directory and plant the registered COM DLL. Starting the Cross Device virtual camera then causes Windows Camera Frame Server to load the attacker-controlled DLL as NT AUTHORITY\LOCAL SERVICE. The payload DLL elevates from LOCAL SERVICE to SYSTEM and starts a staged CORE Impact agent. The module follows the guarded fresh-VM reproduction flow: Requires an x64 agent running at medium integrity. Validates the exact machine-wide Cross Device COM registration and requires PROGRAMDATA\CrossDevice to be absent. Stages the CORE Impact agent, creates PROGRAMDATA\CrossDevice, and plants the payload DLL. Starts the Cross Device virtual camera through Media Foundation. Waits for the new agent and verifies that it is running as NT AUTHORITY\SYSTEM.

This module exploits an information disclosure vulnerability in Microsoft Windows Snipping Tool. A malicious web page invokes the ms-screensketch URI handler with an attacker-controlled UNC path. When the victim allows the browser to open Snipping Tool, the application connects to the SMB server and discloses the current user's Net-NTLM response. This exploit does not install an agent.

Microsoft Windows is vulnerable to a use-after-free in win32kfull!WindowActions::xxxInterceptSetWindowPos. The vulnerability can be triggered while processing deferred window-position operations for intercept windows, allowing freed kernel memory to be reclaimed with attacker-controlled allocations. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the binary exploit are: Create intercept windows and deferred window-position objects to trigger the use-after-free Perform heap feng shui and spray restricted token objects to reclaim the freed allocation Corrupt a duplicated token's user and group information and replace it with SYSTEM security identifiers Impersonate the corrupted token and use winlogon.exe as the parent of a new elevated process Execute the uploaded agent as SYSTEM

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits the ShieldBreak local privilege escalation vulnerability in Microsoft Defender to execute a Core Impact agent with SYSTEM privileges. ShieldBreak bypasses the fix for the RoguePlanet vulnerability (CVE-2026-50656). The exploit combines the Windows Cloud Files API, Object Manager shadow directories and symbolic links, the Common Log File System, and Defender's privileged remediation workflow to redirect a file operation into the native Windows System32 directory. The module patches the ShieldBreak trigger with the full path of the staged Core Impact agent and executes the trigger from memory without writing ShieldBreak.exe to the target filesystem. The exploit creates a Cloud Files placeholder containing detected content and asks Defender to scan and remediate it through MpClient.dll. While remediation is in progress, it changes the placeholder contents and redirects the path used by Defender so the embedded payload is written as C:\Windows\System32\phoneinfo.dll. It then triggers the Windows Error Reporting scheduled task, which loads the payload as SYSTEM and launches the staged Core Impact agent. If an attempt does not install a SYSTEM agent, the module makes one additional attempt. The steps performed by the exploit are: Reads the Microsoft Defender engine version from the registry and verifies that it is version 1.1.26060.3008 or later. Generates and stages a Core Impact agent, patches the ShieldBreak trigger with its full path, and executes the trigger from memory. Creates a Cloud Files synchronization root and a placeholder backed by embedded detected content. Builds Object Manager shadow directories and symbolic links that make the scan path resolve through an attacker-controlled location. Calls Defender through MpClient.dll to scan the placeholder and begin privileged remediation. Coordinates Cloud Files hydration and CLFS file locking, then redirects Defender's file operation to C:\Windows\System32\phoneinfo.dll. Changes the hydrated placeholder to the embedded payload while Defender continues remediation using the redirected path. Triggers the \Microsoft\Windows\Windows Error Reporting\QueueReporting scheduled task so the payload is loaded as SYSTEM. Launches the patched Core Impact agent and verifies that the returned agent has SYSTEM privileges.

This module exploits CVE-2025-37164, an unauthenticated remote code execution vulnerability in HPE OneView. The module first queries the appliance version endpoint, then validates the vulnerability by sending a benign command to the ID Pools executeCommand REST endpoint. If the target is vulnerable, commands are executed through the same endpoint to deploy an OSCI agent or a classic network agent. The vulnerable endpoint does not return command output, so the OSCI agent is committed as a blind command execution primitive.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.