The Windows NT operating system kernel executable (ntoskrnl.exe) present in Microsoft Windows is vulnerable to a race condition, which can result in arbitrary memory write. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit are: Get the kernel address of the current process token Get the security information contained in the token using NtQueryInformationToken Calculate the value address of the first token security attribute Create a thread to win the race condition and enable privileges of the current process Deploy an agent via creating a new elevated process using winlogon.exe as parent process

This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the n_gsm driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.

A directory traversal vulnerability in SolarWinds Serv-U FTP Server allows unauthenticated remote attackers to download system files. To take advantage of this vulnerability, we need to make a request using the InternalDir and InternalFile parameters, this will allow us to trigger a directory traversal and thus be able to read an arbitrary file. This module exploits the directory traversal to download the file specified and to save it locally in the location specified in the "OUTPUT PATH" parameter.

A vulnerability in the RecordGoodApp method allows to unauthenticated remote attackers to execute commands. This function is potentially vulnerable to an SQL injection because it uses string.Format to insert a value into the SQL query.

A SQL injection vulnerability in Fortra FileCatalyst Workflow versions 5.1.6 build 135 and earlier allows remote attackers, including anonymous ones, to exploit a SQL injection via the JOBID parameter. This could lead to unauthorized SQL commands execution such as table deletion or admin user creation. This module without authentication creates an administrative user, proceeds to authenticate with this newly created user to assess if the system is vulnerable. This module does not install an agent but instead creates an administrator user for FileCatalyst.s

This module chains 2 vulnerabilities to deploy an agent in Progress Telerik Report Server that will run with root user privileges. The first vulnerability is an authentication bypass vulnerability present in Telerik.ReportServer.Web.Controllers.StartupController.Register class. The second vulnerability a .NET deserialization vulnerability in Telerik.Reporting.XmlSerialization.XmlSerializer class. This module will use first vulnerability to create a random user with "System Administrator" role against the "/Startup/Register" endpoint and then login into the application. Then, a report with our payload will be uploaded via the "/api/reportserver/report" endpoint. Finally, the second vulnerability will be used to deploy an agent using the "/api/reports/clients" and "/api/reports/clients/clientID/parameters" endpoints. The deployed agent will run with the privileges of the "w3wp" process (TelerikReportServer instance - NT AUTHORITY\\SYSTEM).

This module chains 2 vulnerabilities to deploy an agent in Progress Telerik Report Server that will run with root user privileges. The first vulnerability is an authentication bypass vulnerability present in Telerik.ReportServer.Web.Controllers.StartupController.Register class. The second vulnerability a .NET deserialization vulnerability in Telerik.Reporting.XmlSerialization.XmlSerializer class. This module will use first vulnerability to create a random user with "System Administrator" role against the "/Startup/Register" endpoint and then login into the application. Then, a report with our payload will be uploaded via the "/api/reportserver/report" endpoint. Finally, the second vulnerability will be used to deploy an agent using the "/api/reports/clients" and "/api/reports/clients/clientID/parameters" endpoints. The deployed agent will run with the privileges of the "w3wp" process (TelerikReportServer instance - NT AUTHORITY\\SYSTEM).

An authenticated user can exploit a command injection vulnerability in the web components of Ivanti Connect Secure (9.x and 22.x) to execute arbitrary commands. This module exploits two vulnerabilities. First, it leverages the lack of authentication in "/api/v1/totp/user-backup-code", allowing unauthenticated access and path traversal. Then, it uses this vulnerability to access the system and execute remote commands in "/api/v1/license/key-status/path:node_name". The deployed agent will run with ROOT privileges.

The Windows Client Side Caching Driver (csc.sys) present in Microsoft Windows is vulnerable to a memory corruption vulnerability. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by creating a specially crafted IOCTL request. The steps performed by the binary exploit are: Null Pointer write to arbitrary kernel R/W through a CscDevFcbXXXControlFile routine which is called by RDBSS to pass a device FCB control request to the network mini-redirector not validating the input buffer in IOCTL 0x001401a3 Overwrite the thread's PreviousMode through the NULL pointer and get an arbitrary read/write memory primitive via NtWriteVirtualMemory/NtReadVirtualMemory SYSTEM token stealing Agent deployment through process injection on the LSASS.exe process

This exploit uses InitializeXamlDiagnosticsEx in order to inject a DLL in an elevated process. It will check if any elevated process running uses UWP and then inject. One example of elevated process with UWP is taskmgr. It will check for 180 seconds.