This module exploits CVE-2026-53365, to elevate privileges on a Linux target. The vulnerability is a page-reference-count underflow in the Linux kernel io_uring zero-copy send path over AF_VSOCK. It can free a page that remains pinned and allow the page to be reclaimed as privileged file page-cache data. The exploit uses the vulnerability to modify the interpreter path in the page-cache contents of "/usr/bin/su" and execute a caller-supplied ELF with root privileges. The module uploads the exploit binary and a generated Core Impact agent ELF with random names to the directory selected by the TMP_DIR parameter. After successful exploitation, its setuid helper executes that agent with root privileges. Before exploitation, the module refuses to continue if the cached "/usr/bin/su" image already references the exploit interpreter and removes stale files from previous failed attempts. After the privileged interpreter has executed, the exploit restores the original cached "/usr/bin/su" ELF page through its fixed-buffer alias before tearing down the io_uring worker. After the new agent connects, the module waits for a privileged filesystem-cache eviction, verifies that the cached "/usr/bin/su" image no longer references the exploit interpreter, and removes the uploaded files and fixed-name exploit artifacts. Even after successful restoration, another exploitation attempt requires a reboot because the affected page and allocator state are not reusable during the same boot.

This module exploits CVE-2026-66804, an improper access control vulnerability in the Microsoft Windows Cross Device Service, to execute a CORE Impact agent with NT AUTHORITY\SYSTEM privileges. Windows registers the Cross Device virtual-camera COM server at PROGRAMDATA\CrossDevice\CrossDevice.Streaming.Source.dll. On affected systems, the machine-wide registration can exist while PROGRAMDATA\CrossDevice is absent and creatable by a standard user. An attacker can create that missing directory and plant the registered COM DLL. Starting the Cross Device virtual camera then causes Windows Camera Frame Server to load the attacker-controlled DLL as NT AUTHORITY\LOCAL SERVICE. The payload DLL elevates from LOCAL SERVICE to SYSTEM and starts a staged CORE Impact agent. The module follows the guarded fresh-VM reproduction flow: Requires an x64 agent running at medium integrity. Validates the exact machine-wide Cross Device COM registration and requires PROGRAMDATA\CrossDevice to be absent. Stages the CORE Impact agent, creates PROGRAMDATA\CrossDevice, and plants the payload DLL. Starts the Cross Device virtual camera through Media Foundation. Waits for the new agent and verifies that it is running as NT AUTHORITY\SYSTEM.

Microsoft Windows is vulnerable to a use-after-free in win32kfull!WindowActions::xxxInterceptSetWindowPos. The vulnerability can be triggered while processing deferred window-position operations for intercept windows, allowing freed kernel memory to be reclaimed with attacker-controlled allocations. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the binary exploit are: Create intercept windows and deferred window-position objects to trigger the use-after-free Perform heap feng shui and spray restricted token objects to reclaim the freed allocation Corrupt a duplicated token's user and group information and replace it with SYSTEM security identifiers Impersonate the corrupted token and use winlogon.exe as the parent of a new elevated process Execute the uploaded agent as SYSTEM

This module exploits the ShieldBreak local privilege escalation vulnerability in Microsoft Defender to execute a Core Impact agent with SYSTEM privileges. ShieldBreak bypasses the fix for the RoguePlanet vulnerability (CVE-2026-50656). The exploit combines the Windows Cloud Files API, Object Manager shadow directories and symbolic links, the Common Log File System, and Defender's privileged remediation workflow to redirect a file operation into the native Windows System32 directory. The module patches the ShieldBreak trigger with the full path of the staged Core Impact agent and executes the trigger from memory without writing ShieldBreak.exe to the target filesystem. The exploit creates a Cloud Files placeholder containing detected content and asks Defender to scan and remediate it through MpClient.dll. While remediation is in progress, it changes the placeholder contents and redirects the path used by Defender so the embedded payload is written as C:\Windows\System32\phoneinfo.dll. It then triggers the Windows Error Reporting scheduled task, which loads the payload as SYSTEM and launches the staged Core Impact agent. If an attempt does not install a SYSTEM agent, the module makes one additional attempt. The steps performed by the exploit are: Reads the Microsoft Defender engine version from the registry and verifies that it is version 1.1.26060.3008 or later. Generates and stages a Core Impact agent, patches the ShieldBreak trigger with its full path, and executes the trigger from memory. Creates a Cloud Files synchronization root and a placeholder backed by embedded detected content. Builds Object Manager shadow directories and symbolic links that make the scan path resolve through an attacker-controlled location. Calls Defender through MpClient.dll to scan the placeholder and begin privileged remediation. Coordinates Cloud Files hydration and CLFS file locking, then redirects Defender's file operation to C:\Windows\System32\phoneinfo.dll. Changes the hydrated placeholder to the embedded payload while Defender continues remediation using the redirected path. Triggers the \Microsoft\Windows\Windows Error Reporting\QueueReporting scheduled task so the payload is loaded as SYSTEM. Launches the patched Core Impact agent and verifies that the returned agent has SYSTEM privileges.

This module exploits an elevation of privilege vulnerability in Windows WalletService to achieve arbitrary code execution with NT AUTHORITY\\SYSTEM privileges. The exploit performs the following steps: Prepares a controlled Wallet store containing a persisted callback. Temporarily redirects the current user's Documents known folder to the controlled store. Triggers WalletService through the Windows Wallet APIs. Starts a SYSTEM-level CORE Impact agent from the WalletService callback. Restores the original Documents known folder and removes temporary artifacts when possible.

Microsoft Install Service grants an interactive standard user write access to plugin configuration beneath HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\State. The service consumes this configuration while running as SYSTEM. The module writes an agent DLL to a publicly readable directory, registers a fresh plugin name in PlugInList and StaticPluginMap, and invokes AppInstallManager.SearchForAllUpdatesAsync(). Install Service then loads the agent DLL as SYSTEM.

The Microsoft Windows NT OS Kernel is affected by an elevation of privilege vulnerability. This module executes a BOF payload that attempts to elevate the current agent process to SYSTEM privileges. The steps performed by the exploit to elevate privileges are: Prepare WMI QuerySingleMultiple buffers and spray NPFS pipe objects in kernel pool Open a WMIDataDevice handle and resolve a WMI instance suitable for the vulnerable query path Trigger the vulnerable WMI query to corrupt an adjacent pipe object Use the corrupted pipe to leak kernel pool metadata and build an arbitrary read primitive Locate the current process and SYSTEM process objects, then read the SYSTEM token Self-elevate the current agent by writing the SYSTEM token into its own process token field

This module exploits pedit COW, a local privilege escalation vulnerability in the Linux kernel tracked as CVE-2026-46331. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the pedit COW trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

This module exploits DirtyClone, a local privilege escalation vulnerability in the Linux kernel. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the DirtyClone trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

This module exploits the RoguePlanet local privilege escalation vulnerability in Microsoft Defender to execute a Core Impact agent with SYSTEM privileges. The exploit abuses Defender's privileged remediation workflow. RoguePlanet first prepares an attacker-controlled Windows Error Reporting path under a writable temporary directory and forces Defender to scan it. While Defender is cleaning the detected content, the trigger uses file-system synchronization primitives to redirect operations that started in the temporary tree so they later resolve inside the native Windows directory. After the Windows Error Reporting executable is reached through that redirected path, the module triggers the Windows Error Reporting scheduled task. When the executable starts as SYSTEM, RoguePlanet uses its named-pipe handoff to duplicate the SYSTEM token into the interactive session and launch the staged Core Impact agent. Because the primitive depends on race timing, the module records trigger output, retries failed attempts, verifies the returned agent privileges, and restores the original Windows Error Reporting executable. The public RoguePlanet proof of concept reports reliable exploitation on some systems and intermittent failures on others due to race timing. The exploit has been reported as tested against Windows 10 and Windows 11 systems with June 2026 patches installed. The steps performed by the exploit are: Resolves the native Windows and temporary paths, backs up the Windows Error Reporting executable, and stages the Core Impact agent with the RoguePlanet trigger. Starts the trigger as the current non-SYSTEM user. The trigger creates the RoguePlanet named pipe, mounts its embedded ISO, and creates a controlled temporary System32\\wermgr.exe path. Calls Defender through MpClient.dll so MpScanStart detects the staged content and MpCleanStart begins privileged remediation against the controlled path. Coordinates the race by watching for the new shadow-copy device, opening the staged file's alternate data stream, using oplocks and ReadDirectoryChangesW for timing, and repeatedly swapping directories with junctions. Turns the parent temporary directory into a junction to the native Windows directory so Defender cleanup and Windows Error Reporting file operations resolve to the real Windows Error Reporting executable. Triggers the \\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting scheduled task, causing Windows Error Reporting to start as SYSTEM. Completes the SYSTEM handoff over the RoguePlanet named pipe, duplicates the SYSTEM token into the pipe server's session, and launches the staged Core Impact agent with CreateProcessAsUserA. Captures trigger output, retries timing-dependent failures, verifies SYSTEM privileges, and restores the backed-up executable.