This module exploits an elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) to achieve arbitrary code execution with SYSTEM privileges. The vulnerability resides in the HsmOsBlockPlaceholderAccess routine and abuses the Cloud Files abort hydration path to create attacker-controlled registry keys in the .DEFAULT user hive without proper access checks. MiniPlasma is the same issue previously tracked as CVE-2020-17103, which was reported by Google Project Zero and later claimed to be patched, but it remains exploitable on current Windows builds. The steps performed by the exploit are: Creates a controlled Cloud Files synchronization root and uses the abort hydration path to trigger the race condition. Redirects privileged registry key creation into the .DEFAULT user hive. Abuses the writable .DEFAULT Volatile Environment registry key to control the windir environment used by a SYSTEM process. Triggers the elevated process to launch a CORE Impact agent with SYSTEM privileges in the target user's interactive session.

This module abuses Jolokia access to invoke the ActiveMQ Broker MBean addNetworkConnector operation. The crafted connector uses the VM transport brokerConfig option to load a Spring XML document from the IMPACT web server. The XML instantiates java.lang.ProcessBuilder and executes the agent deployment command sequence. The exploitation process performs the following steps: Starts the IMPACT web server and registers a randomized Spring XML payload path. Checks that the target Jolokia endpoint is reachable with the configured credentials. Discovers the ActiveMQ broker name through Jolokia, or uses the configured broker name when provided. Builds a malicious network connector URI using vm:// and brokerConfig=xbean to reference the Spring XML payload hosted by IMPACT. Sends a Jolokia exec request to call addNetworkConnector(java.lang.String) on the ActiveMQ Broker MBean. Waits for the target to fetch the Spring XML payload and execute the generated agent deployment command sequence. The deployed agent will run with the same privileges as the Apache ActiveMQ service.

This module exploits CVE-2026-33017 by abusing Langflow's public temporary flow build endpoint to inject and execute a custom component. The component runs operating system commands through the Langflow Python process. If AUTO_LOGIN is enabled on the target, the module can automatically create a public flow. Otherwise, provide a known public FLOW ID. If no FLOW ID is provided, the module can use AUTO_LOGIN to obtain an access token and create a public Langflow flow. The module then submits a crafted temporary custom component to the /api/v1/build_public_tmp/{flow_id}/flow endpoint. That component executes operating system commands through the Langflow Python process and returns command output through Langflow build events. When DEPLOY OSCI AGENT is enabled, the module commits an OSCI agent that reuses the same Langflow primitive to relaunch commands later. When DEPLOY NETWORK AGENT is enabled, the module stages an Impact payload from the embedded web server and launches it through the vulnerable Langflow service. The module polls Langflow job events to track execution and confirm whether command execution or agent deployment succeeded. The deployed agent will run with the privileges of the Langflow service account.

This module exploits a Time-Of-Check Time-Of-Use (TOCTOU) race condition within the Windows Defender remediation process to achieve arbitrary code execution with SYSTEM privileges. The exploit chain leverages the Windows Cloud Files API (cfapi) and an EICAR test string to purposely pause the antivirus engine's remediation thread using a Batch Oplock. During this suspended state, the module uses NTFS mount points (directory junctions) to redirect the highly privileged antivirus file operations from a temporary directory to a protected system folder (C:\Windows\System32). When the oplock is released, the antivirus mistakenly overwrites a legitimate system binary (TieringEngineService.exe) during its cleanup routine. The module then replaces this corrupted binary with a malicious payload and triggers a specific COM object to start the service, yielding a SYSTEM agent. The steps performed by the exploit are: Creates a decoy executable containing a dynamically generated EICAR test string within a temporary directory to trigger an immediate antimalware response. Registers the temporary directory as a Cloud Sync Root and converts the decoy file into a cloud placeholder to intercept system interactions. Freezes the highly privileged antivirus remediation thread at a precise moment by requesting a Batch Oplock that trips when the engine scans the placeholder file. Executes a TOCTOU race condition by renaming the original directory and replacing it with an NTFS mount point targeting C:\Windows\System32. Releases the oplock, tricking the antivirus engine into blindly overwriting the target service binary (TieringEngineService.exe) as part of its automated threat remediation. Replaces the overwritten service binary with the exploit payload and invokes the Tiering Management Engine COM object to start the service as NT AUTHORITY\SYSTEM. Creates a named pipe to get the current session id and executes an interactive CORE Impact agent directly into the target user's desktop session.

This module exploits a Time-Of-Check Time-Of-Use (TOCTOU) race condition within the Windows Defender signature update mechanism to achieve arbitrary code execution with SYSTEM privileges. The exploit chain leverages Cloud Files oplocks and an EICAR synchronization trigger to purposefully freeze Windows Defender's I/O operations. During this paused state, the module uses NTFS directory junctions and Object Manager symbolic links to redirect Defender's file access from a legitimate signature update file to the locked SAM database within a Volume Shadow Copy (VSS). After reading the SAM hive into memory, the module performs offline AES/DES decryption to harvest local NTLM hashes. Finally, it uses the pass-the-hash technique to temporarily reset an administrator's password, creates a self-deleting Windows service, and injects an interactive SYSTEM-level agent directly into the target user's desktop session. The steps performed by the exploit are: Downloads the Windows Defender signature update and extracts the required files directly into memory to evade disk-based detection. Freezes Windows Defender's file input/output operations at a precise moment by chaining an EICAR test file trigger with Cloud Files oplocks. Captures the exact object namespace path of the temporary Volume Shadow Copy (VSS) generated during Defender's remediation workflow. Executes a TOCTOU race condition using an NTFS junction and Object Manager symlink to trick Defender into opening the locked SAM database instead of the signature file. Reads the SAM database contents into memory and utilizes offline AES and DES decryption to extract local NTLM hashes. Employs a pass-the-hash technique to temporarily alter an administrator password, registers a self-deleting service to achieve SYSTEM privileges, and injects a CORE Impact agent into the active user's desktop session.

ATBroker.exe (Windows Accessibility Infrastructure) resolves AT configuration from the per-user ATConfig path but performs unsafe file/registry operations. A registry symlink race condition in the ATConfig handling lets a local attacker write arbitrary values into protected HKLM keys and redirect the configuration load to a malicious AT entry, leading to arbitrary code execution as SYSTEM. The steps performed by the exploit are: Write target value to ATConfig registry path Set oplock on oskmenu.xml Lock workstation Wait for oplock (user interaction) Start target service (run agent as SYSTEM)

This vulnerability involves the improper neutralization of special elements used in a command ('command injection') in Windows MSHTML, allowing an unauthorized attacker to execute a crafted DLL file located in a shared folder and bypass Mark of the Web. The steps performed by the exploit are: Creates a DLL containing an Impact agent and places it in an SMB file share. It also creates an .lnk file for direct access. Using the provided link, download the .lnk file in the browser. Because some browsers may change the .lnk extension, you can set ATTACH_FILE_NAME to end with .zip to send the .lnk inside a ZIP file. If necessary, unzip the file and run the .lnk file. Alternatively, run the .lnk directly from the SMB share using the direct link. If the target can access the SMB share on the Impact machine, the agent will be deployed without Mark of the Web or popup warnings.

The vulnerability exists in the WebObjects request handling mechanism where improper validation of the badparam parameter allows attackers to bypass authentication controls. The exploit performs the following steps: Connects to SolarWinds Web Help Desk and retrieves initial session cookies. Searches through headers, cookies, and HTML for the WebObjects session identifier. Accesses a special route with manipulated 'badparam' parameters to test the bypass. Exploits the improperly validated 'badparam' parameter to bypass login and obtain admin session. Creates a persistent URL that allows direct unauthorized access to the administrative panel.

This module exploits an unauthenticated arbitrary file upload in SmarterMail. The vulnerability consists of the arbitrary uploading of a non-binary file (asp, html, txt, etc.) to any location on the target machine without user authentication. However, the SmarterMail server listening on port 9998 (SYSTEM) simply uploads the file but cannot execute ASPX files. Furthermore, if the IIS server on port 80 is active, the file can be written to the root directory of that server and executed through it, with the permissions of the IIS user (a High Integrity Level user). The exploit first verifies that the target SmarterMail service is active and listening on its default administrative port, TCP/9998. It crafts a specially formed multipart/form-data POST request containing a malicious ASPX web shell. The request exploits an improper input validation vulnerability to perform directory path traversal (e.g., using sequences like ../../../). This bypasses the intended upload directory restrictions, allowing the file to be written to critical locations such as: 1)The SmarterMail web root (e.g., /interface/app/authentication/) 2)The root directory of the IIS web server hosting the application. After a successful upload, the script verifies the shell's deployment by sending an HTTP GET request to access the uploaded .aspx file. Primary access is attempted via the SmarterMail service on port 9998. A second check is performed via the standard IIS web service on port 80 (if listening). The web shell is designed to execute operating system commands passed via HTTP query parameters and return the command output within the HTTP response. As a demonstration of post-exploitation capabilities, If port 80 is listening can optionally deploy a Core Impact agent fileless HTA.

An authorization bypass vulnerability exists in the AsIO3.sys functionality of Asus Armoury Crate. A specially crafted hard link can lead to an authorization bypass. An attacker can create a hard link to trigger this vulnerability. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit to elevate privileges are: Leak the address of the current thread Leak the address of the current process token Leak the address of the SYSTEM process token Trigger the vulnerability to bypass the authorization Abuse the driver to overwrite PreviousMode Replace the current process token with the SYSTEM token Restore original PreviousMode value