Local Privilege Escalation in Windows WalletService

This repository is a working local privilege-escalation proof of concept for CVE-2026-49176 affecting Windows WalletService. It is not a framework module; it is a standalone exploit chain composed of PowerShell orchestration plus several native Windows binaries. Repository structure and purpose: - README.md explains the vulnerability and usage. - trigger.ps1 is the main entry point. It verifies the user is non-admin, prepares a per-run workspace under LOCALAPPDATA, copies payload components, seeds a malicious wallet database, redirects the current user’s Documents known folder to the attacker-controlled directory, triggers WalletManager::RequestStoreAsync, waits for a result log, restores the original Documents path, and validates that a SYSTEM shell was created in the expected session. - run.cmd is a convenience launcher for trigger.ps1. - build.ps1 compiles four native components with Visual Studio tools. - src/documents_path.c is a helper that gets/sets FOLDERID_Documents via SHGetKnownFolderPath and SHSetKnownFolderPath. - src/wallet_ese_seed.c creates an ESE database wallet.db with a Cards table and a Computed column configured with a persisted callback string of the form DLL!EXPORT. This is the malicious database WalletService later opens. - src/wallet_callback_shell.c is the DLL intended to be loaded by ESE persisted callbacks under LocalSystem. On DLL load it verifies it is running as SYSTEM, locates sibling files, creates a temporary Windows service pointing to shell_broker.exe and result.txt, starts it, deletes the service, and logs status. - src/shell_broker.c is the final stage. Running as SYSTEM, it duplicates its token into the active console session, enables needed privileges, and launches C:\Windows\System32\cmd.exe on winsta0\default, producing an interactive SYSTEM shell for the logged-in user. It also appends structured status lines to result.txt. Exploit capability: The exploit provides reliable local privilege escalation from a standard user to an interactive NT AUTHORITY\SYSTEM command prompt. It abuses WalletService’s handling of the user Documents folder and attacker-controlled wallet.db, specifically persisted ESE callbacks, to achieve DLL loading as LocalSystem. The payload is operational and complete, including orchestration, malicious database creation, callback DLL, service-based broker, session transfer, logging, and cleanup/restoration of the Documents path. No network communication is present. The attack vector is purely local and heavily tied to Windows filesystem paths, known-folder redirection, ESE database internals, and Windows service/token APIs.