The module authenticates to Configuration Manager AdminService with a low-privileged domain identity and calls UploadExtensionInChunks. The exploit uses an Authenticode-signed CAB to extract a path traversal to place an adsource.dll proxy and a preserved original DLL in the Configuration Manager bin X64 directory. Active Directory System Discovery subsequently loads the proxy in SMS_EXECUTIVE and modifies the built-in RID-500 account as NT AUTHORITY\\SYSTEM. The module then authenticates over SMB with that local administrator and deploys an Impact agent as SYSTEM. An HTTP 500 response can occur after successful CAB extraction and is therefore not treated as definitive failure. The agent callback is the success condition.

ResetNightmare is an authorization flaw in the Microsoft Kerberos Change Password protocol. On an unpatched domain controller, an attacker who can write the userPrincipalName attribute of a controlled account can obtain a kadmin/changepw ticket whose client name identifies another account while its PAC identifies the controlled account. The module temporarily changes the controlled account's UPN to the target sAMAccountName, requests a kadmin/changepw ticket with an NT-ENTERPRISE client name, restores the original UPN, and uses the ticket in an RFC 3244 password-change exchange. The target credentials are verified and stored as an Impact identity by default. The controlled account can be an existing user or computer whose cleartext password is known and whose userPrincipalName can be modified.

This module exploits CVE-2026-66804, an improper access control vulnerability in the Microsoft Windows Cross Device Service, to execute a CORE Impact agent with NT AUTHORITY\SYSTEM privileges. Windows registers the Cross Device virtual-camera COM server at PROGRAMDATA\CrossDevice\CrossDevice.Streaming.Source.dll. On affected systems, the machine-wide registration can exist while PROGRAMDATA\CrossDevice is absent and creatable by a standard user. An attacker can create that missing directory and plant the registered COM DLL. Starting the Cross Device virtual camera then causes Windows Camera Frame Server to load the attacker-controlled DLL as NT AUTHORITY\LOCAL SERVICE. The payload DLL elevates from LOCAL SERVICE to SYSTEM and starts a staged CORE Impact agent. The module follows the guarded fresh-VM reproduction flow: Requires an x64 agent running at medium integrity. Validates the exact machine-wide Cross Device COM registration and requires PROGRAMDATA\CrossDevice to be absent. Stages the CORE Impact agent, creates PROGRAMDATA\CrossDevice, and plants the payload DLL. Starts the Cross Device virtual camera through Media Foundation. Waits for the new agent and verifies that it is running as NT AUTHORITY\SYSTEM.

This module exploits an information disclosure vulnerability in Microsoft Windows Snipping Tool. A malicious web page invokes the ms-screensketch URI handler with an attacker-controlled UNC path. When the victim allows the browser to open Snipping Tool, the application connects to the SMB server and discloses the current user's Net-NTLM response. This exploit does not install an agent.

Microsoft Windows is vulnerable to a use-after-free in win32kfull!WindowActions::xxxInterceptSetWindowPos. The vulnerability can be triggered while processing deferred window-position operations for intercept windows, allowing freed kernel memory to be reclaimed with attacker-controlled allocations. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the binary exploit are: Create intercept windows and deferred window-position objects to trigger the use-after-free Perform heap feng shui and spray restricted token objects to reclaim the freed allocation Corrupt a duplicated token's user and group information and replace it with SYSTEM security identifiers Impersonate the corrupted token and use winlogon.exe as the parent of a new elevated process Execute the uploaded agent as SYSTEM

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits the ShieldBreak local privilege escalation vulnerability in Microsoft Defender to execute a Core Impact agent with SYSTEM privileges. ShieldBreak bypasses the fix for the RoguePlanet vulnerability (CVE-2026-50656). The exploit combines the Windows Cloud Files API, Object Manager shadow directories and symbolic links, the Common Log File System, and Defender's privileged remediation workflow to redirect a file operation into the native Windows System32 directory. The module patches the ShieldBreak trigger with the full path of the staged Core Impact agent and executes the trigger from memory without writing ShieldBreak.exe to the target filesystem. The exploit creates a Cloud Files placeholder containing detected content and asks Defender to scan and remediate it through MpClient.dll. While remediation is in progress, it changes the placeholder contents and redirects the path used by Defender so the embedded payload is written as C:\Windows\System32\phoneinfo.dll. It then triggers the Windows Error Reporting scheduled task, which loads the payload as SYSTEM and launches the staged Core Impact agent. If an attempt does not install a SYSTEM agent, the module makes one additional attempt. The steps performed by the exploit are: Reads the Microsoft Defender engine version from the registry and verifies that it is version 1.1.26060.3008 or later. Generates and stages a Core Impact agent, patches the ShieldBreak trigger with its full path, and executes the trigger from memory. Creates a Cloud Files synchronization root and a placeholder backed by embedded detected content. Builds Object Manager shadow directories and symbolic links that make the scan path resolve through an attacker-controlled location. Calls Defender through MpClient.dll to scan the placeholder and begin privileged remediation. Coordinates Cloud Files hydration and CLFS file locking, then redirects Defender's file operation to C:\Windows\System32\phoneinfo.dll. Changes the hydrated placeholder to the embedded payload while Defender continues remediation using the redirected path. Triggers the \Microsoft\Windows\Windows Error Reporting\QueueReporting scheduled task so the payload is loaded as SYSTEM. Launches the patched Core Impact agent and verifies that the returned agent has SYSTEM privileges.

This module exploits an elevation of privilege vulnerability in Windows WalletService to achieve arbitrary code execution with NT AUTHORITY\\SYSTEM privileges. The exploit performs the following steps: Prepares a controlled Wallet store containing a persisted callback. Temporarily redirects the current user's Documents known folder to the controlled store. Triggers WalletService through the Windows Wallet APIs. Starts a SYSTEM-level CORE Impact agent from the WalletService callback. Restores the original Documents known folder and removes temporary artifacts when possible.

This module sends a crafted HTTP/1.1 request over TLS to a service backed by the Windows HTTP Protocol Stack driver, HTTP.sys. The request contains a large number of compact headers. The exploit uses LINE mode, sending each complete HTTP line in a separate TLS application-data write to align with the ZDI trigger mechanics and accumulate HTTP.sys buffer references.