Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-9435 — ADManager Plus Build < 7230 Elevation of Privilege | Kitploit
Tools/GitHubGitHub/passtheticket/cve-2025-9435
Privilege EscalationVulnerability AnalysisExploitationPenetration TestingPayload Development
GitHubpasstheticket/cve-2025-9435

CVE-2025-9435

ADManager Plus Build < 7230 Elevation of Privilege

View Repository
18 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

ADManager Plus Build < 7230 Elevation of Privilege (CVE-2025-9435)

Requirements

A technician user with the 'Modify user general properties' role and logon access to the server where ADManager is installed.

Description

If the technician user has logon rights on the server , they can escalate privileges to the service account or the user account that runs the Admanager with high privileges. The user can create an arbitrary directory through the web application and then copy a DLL file into this directory. When ADManager is restarted, the DLL file is executed with the privileges of the user running ADManager.

Proof Of Concept

  1. Log in as the technician user and click Profile Attributes.
  2. Select “Home folder” and “Connect” box type an arbitrary network path. Then enter the name of the logged tecnician user and click search.
  3. Capture the request with BurpSuite and set ....\\jre\\lib\\ext\\amd64 value to homeDirectory parameter and forward request.
  4. Select the technician user and click “Apply”.
  5. A directory named amd64 will be created under the C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext directory. The technician user has Full control over the amd64 directory.
  6. Create malicious sunmscapi.dll or sunec.dll (this DLL could cause the ADManager Plus application to fail to start) DLL file to obtain reverse shell.
  7. Log in to the server where ADManager is installed as the technician user. Copy the DLL files to C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext\amd64. Under normal conditions, the user can not copy files under the C:\Program Files\ManageEngine\ADManager Plus\jre\lib\ext\ directory due to insufficient privilege. However, the user obtains write right under the “amd64” directory exploiting arbitrary directory creating vulnerability and can copy these files.
  8. After ADManager is restarted, the DLL file will be executed and reverse shell will be obtained with high privileges.

PoC Details

https://docs.unsafe-inline.com/0day/admanager-plus-build-less-than-7230-elevation-of-privilege-vulnerability

Download Tool