zypherion-technologies/vulnariumA security research archive documenting vulnerabilities, technical analysis, and PoC demonstrations.
Two independent lpes, msi is more of a uacbypass via toctou and NL is just LPE vulns found during security research. Each has a working proof of concept.
Elevation through the MSI Center service bridge and terminal server.
MSI Center runs a SYSTEM service (MSI_Center_Service) that exposes a local TCP bridge on port 32683. Any process on the machine can connect to it. Therefore bridge accepts a control code that starts a second listener, the terminal server, on port 26822. That terminal server accepts JSON commands, one of which is RunSetupModule. The command takes a component name, a parameter string, and a list of dependent files. The service resolves the dependent files into C:\MSI\MSI Center\Setup, then executes the component at high integrity.
The PoC sends a RunSetupModule request referencing a dependent file called elevcmd.exe. While the service is setting up the directory, the PoC drops a copy of cmd.exe into the setup path under that name. The service picks it up and runs it elevated. The spawned process inherits the service's high integrity level, so a standard user ends up with an elevated command prompt without ever seeing a UAC dialog.
MSI-Elev.go
Arbitrary file write into the NetLimiter install directory via CNLService.InstallIp2LocDB. The service extracts a zip archive into a path under ProgramData without sanitising the destination. A directory junction redirects the extraction into Program Files, planting a malicious NLog target DLL that the SYSTEM service loads on next log event.
2 things u can do, either restart ot see result asap ( the service with admin) , or u can simply just reboot and since it runs on startup itll triger automatically.
Reported: 17 July 2026
The MSI Center vulnerability was privately reported to MSI PSIRT with a detailed technical report, reproduction methodology, impact analysis, and proof of concept.
MSI acknowledged receipt of the report and stated that it had been forwarded to the relevant team for further review. No substantive follow-up regarding validation, acceptance, rejection, remediation, or vulnerability tracking was provided to the researcher after that.
The associated support ticket was later closed without a substantive vulnerability disposition.
MSI's published PSIRT process states that it aims to acknowledge reports within three business days and make reasonable efforts to respond within thirty days of the initial acknowledgement regarding whether a vulnerability is confirmed, accepted, or rejected.
Reported: 20 July 2026
The NetLimiter vulnerability was privately reported to Locktime Software with a detailed technical description, reproduction information, impact analysis, and functional proof of concept.
The vulnerability was not publicly disclosed at the time of the initial report. The researcher explicitly stated that the technical details would remain private while the vendor investigated and addressed the issue.
No public remediation or security advisory had been received by the researcher at the time of publication.
Both vulnerabilities were reported privately and in good faith before any public disclosure. Neither vendor provided a substantive response. MSI closed the ticket without addressing the vulnerability. Locktime Software did not reply at all.
This repository publishes the research for educational, defensive, and vulnerability-analysis purposes after the vendors were given the opportunity to investigate and remediate.
The proof-of-concept material is not intended to facilitate unauthorised attacks against third-party systems. Users are responsible for obtaining appropriate authorisation before reproducing the research.
Publication of security research and proof-of-concept source code is protected under several legal frameworks.
Code as protected speech. U.S. federal courts have recognised source code as expressive speech protected by the First Amendment. Bernstein v. U.S. Department of Justice, 176 F.3d 1132 (9th Cir. 1999), held that source code qualifies for First Amendment protection. Junger v. Daley, 209 F.3d 481 (6th Cir. 2000), independently adopted the same reasoning.
CFAA and good-faith security research. In May 2022 the U.S. Department of Justice revised its charging policy for the Computer Fraud and Abuse Act, directing prosecutors to decline prosecution of good-faith security research. The policy defines good-faith research as accessing a computer solely for purposes of testing, investigation, or correction of a security flaw, conducted in a manner designed to avoid harm to individuals or the public.
DMCA security testing exemption. 17 U.S.C. Section 1201(j) provides an express exemption for circumvention performed for the purpose of security testing. The Library of Congress has renewed and expanded these protections in successive rulemaking cycles.
EU coordinated vulnerability disclosure. The NIS2 Directive (2022), Article 12, establishes coordinated vulnerability disclosure requirements and tasks CSIRTs with national CVD processes. The Cyber Resilience Act (2024) further requires vendors to handle disclosed vulnerabilities through defined procedures.
GitHub's policy on dual-use security content. GitHub explicitly permits proof-of-concept and security research repositories. Their policy states that GitHub "allows dual-use content and supports the posting of content that is used for research into vulnerabilities, malware, or exploits, as the publication and distribution of such content has educational value and provides a net benefit to the security community." Removal only applies when a repository is actively being used as infrastructure for ongoing attacks.
Both vulnerabilities in this repository were reported to the respective vendors before any public disclosure took place. Neither vendor provided a substantive response. The research was conducted in good faith with the goal of improving the security of the affected products.
This section is provided for informational purposes and does not constitute legal advice.
Copyright (c) 2026 Zypherion Technologies. All rights reserved.
Permission is granted to use, reproduce, and distribute the contents of this repository for defensive security research, security education, vulnerability analysis, and authorised penetration testing, provided that all of the following conditions are met:
All other rights are reserved. For commercial licensing or any use not covered above, contact [email protected].
