Privilege Escalation in Windows Admin Center

WACJack is a standalone C#/.NET 8 Windows research exploit codebase for reproducing the Windows Admin Center authentication-reflection chain associated with CVE-2026-26119 in an isolated lab. It is not a framework module. The repository is structured into a CLI front end (src/WACJack.Cli), core orchestration and models (src/WACJack.Core), HTTP/WAC and simulation infrastructure (src/WACJack.Infrastructure), plus documented but partially omitted native Windows DCOM/RPC components referenced throughout the solution and docs. The main entry point is src/WACJack.Cli/Program.cs, which exposes commands for probe, plan, inspect-rpc, listen-rpc, simulate, and exploit. Core exploit capability: the code models a two-exchange live authentication bridge rather than a simple token replay. AttackOrchestrator drives a sequence of probing the target WAC gateway, priming session authentication, creating a first live RPC-to-HTTP authentication exchange to establish a WAC session, priming command authentication, creating a second independent exchange, and invoking a WAC command endpoint. The HTTP side is implemented in HttpWacGateway, which uses strict HTTPS, no implicit credentials, no proxy, no redirects, HTTP/1.1 connection affinity, bounded reads, and explicit Negotiate handling. The code supports both legacy and modern WAC API dialects, specifically /api/services/WinREST/Powershell/nodes/{node}/InvokeCommand and /api/PowerShell/nodes/{node}/invokeCommand. The exploit targets Microsoft Windows Admin Center and relies on Windows-native DCOM/RPC coercion and Kerberos/SPNEGO reflection concepts described in the docs. The documentation and code reference remote activation of the AD CS CertSrv Request COM class CLSID {D99E6E74-FC88-11D0-B498-00A0C90312F3}, OXID resolution, a controlled object-exporter binding, and a later RPC association expected to request the SPN HTTP/<WAC host>. The repository emphasizes that the resolver association itself should use RPCSS/<remote server name>, and that successful exploitation requires two distinct live authentications that resolve to the same authenticated machine principal. Payload behavior is restrained but real: the default command is whoami.exe, and WacCommandEvidence wraps it with random begin/end markers to verify that the returned top-level JSON output field contains exactly one line proving NT AUTHORITY\SYSTEM. Arbitrary commands can be supplied via --command, but only whoami receives strict proof-correlation logic. There is no persistence, reverse shell, credential dumping helper, or destructive payload in the provided code. Repository maturity appears OPERATIONAL rather than mere POC because the code contains a connected orchestrator, HTTP client, simulation backend, CLI, and explicit live exploit path behind --experimental-real-http. However, the project itself repeatedly states that end-to-end lab validation remains incomplete and that live results may remain inconclusive without authenticated-principal evidence and SYSTEM proof. The included simulation backend is deterministic and intentionally reports NotAssessed, showing that the repository contains both safe simulation and an experimental real attack path. Notable files: README.md and docs/*.md provide extensive architecture, failure semantics, lab validation, and native backend design. src/WACJack.Cli/CliOptions.cs defines operator-controlled target, port, node mode, listener IP/port, SPN override, command, timeout, and TLS validation options. src/WACJack.Core/Services/AttackOrchestrator.cs contains the main exploit workflow and verdict logic. src/WACJack.Infrastructure/Http/HttpWacGateway.cs implements probing, authentication priming, session creation, and command invocation over WAC. src/WACJack.Infrastructure/Http/WacCommandEvidence.cs implements nonce-correlated SYSTEM verification. Simulation classes provide a non-live test harness. Overall, this is a focused Windows network/web exploit research tool for WAC authentication reflection and privileged command execution validation, not just a detector or README-only repository.

This repository is a small standalone exploit PoC for CVE-2026-26119 targeting Microsoft Windows Admin Center. It contains one executable Python script (wac_rce.py), a README with usage and reverse-shell examples, and a license file. The script is the clear entry point. Exploit flow: the script creates a requests session, disables TLS verification, fetches the WAC login page to scrape a CSRF token, requests /api/user/key to obtain a JWK containing an RSA public key, encrypts the username/password/CSRF JSON with RSA-OAEP(SHA-256), and submits the encrypted packet to /api/user/login. After successful authentication, it verifies that the XSRF-TOKEN cookie is present. It then abuses the WinREST PowerShell endpoint /api/services/WinREST/PowerShell/nodes/dc/invokeCommand to execute arbitrary operator-supplied PowerShell on the remote node. If execution is asynchronous, it polls the corresponding job endpoint until completion and prints returned results and errors. Main capability: authenticated remote code execution as arbitrary PowerShell command execution through Windows Admin Center. The default command is whoami, but any PowerShell can be supplied. The README demonstrates practical post-exploitation by launching a hidden PowerShell reverse shell encoded with -enc and connecting back to a netcat listener. Repository structure is minimal and purpose-built: README documents the vulnerability and operator workflow; wac_rce.py implements the full exploit chain; there is no framework integration, scanning logic, or detection-only behavior. The exploit is operational rather than merely demonstrative because it performs real authentication and command execution, but payload customization is manual via command-line input rather than integrated into a larger exploitation framework.

This repository is a small standalone exploit PoC for CVE-2026-26119 targeting Microsoft Windows Admin Center. It contains one Python exploit script (wac_rce.py), a README with usage and reverse-shell examples, and a license file. The script is not part of a larger exploitation framework. The exploit performs an authenticated attack chain against the Windows Admin Center web/API interface. It first requests the login page to scrape a CSRF token, then calls '/api/user/key' to obtain a JWK RSA public key. It uses that key to OAEP-encrypt a JSON blob containing username, password, and CSRF token, then submits the encrypted packet to '/api/user/login'. After successful authentication, it checks for the 'XSRF-TOKEN' cookie and uses that token in the 'x-xsrf-token' header. For code execution, the script sends an operator-controlled PowerShell command to '/api/services/WinREST/PowerShell/nodes/dc/invokeCommand'. If execution is asynchronous, it polls '/api/services/WinREST/PowerShell/nodes/dc/invokeCommand/{job_id}' until completion, then prints returned results and errors. This gives the operator arbitrary remote PowerShell execution via the WinREST API. Notable implementation details: the default target is hardcoded as 'https://dc.danglingtree.htb:6600' but can be overridden with the WAC_BASE environment variable; password can also be supplied via WAC_PASS. TLS verification is explicitly disabled. The node name 'dc' is hardcoded in the API path, which may require adjustment for other environments. The README demonstrates both simple command execution ('whoami') and post-exploitation by launching a PowerShell reverse shell that connects back to a listener on TCP port 4444. Overall, this is a real operational exploit script rather than a detector: it authenticates, abuses a PowerShell execution API, and can be used directly for command execution or to stage a reverse shell.