n0isegat3/regpwnbrc4bofBrute Ratel C4 BOF that exploits a registry symlink race condition in Windows Accessibility ATConfig to escalate privileges to SYSTEM by writing arbitrary HKLM registry values.
My Brute Ratel C4 BOF reimplementation of port of the RegPwn exploit by Filip Dragovic (@Wh04m1001) / MDSec ActiveBreach.
This is a sloppier BRc4 BOF reimplementation of the Flangvik's CS BOF reimplementation of the original C# exploit. All credit still goes for the vulnerability research and exploit goes to Filip Dragovic and MDSec.
Exploits a registry symlink race condition in the Windows Accessibility ATConfig mechanism to write arbitrary values to protected HKLM registry keys from a normal user context (Local Privilege Escalation).
Targets Windows 11 25H2/24H2, Windows 10 21H2, and Windows Server 2016/2019/2022 prior to the March 2026 patch.
WARNING: This exploit locks the workstation as part of the race condition.
The msiserver (Windows Installer) service ImagePath. This service runs as SYSTEM and can be started by normal users.
badger> coffexec c:\maldev\projects\RegPwnBRc4BOF\regpwn.x64.o C:\JustAnotherPath\badger.exe SYSTEM\ControlSet001\Services\msiserver ImagePath
Requires x86_64-w64-mingw32-gcc (MinGW-w64 cross compiler).
make # build BOF (regpwn.x64.o)
make test # build standalone EXE (regpwn.x64.exe)
make clean
x64 only.