{"uuid": "e9775419-e79f-4b22-86f4-23ada30175c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30204", "content": "\ud83d\udd25 Windows LPE Exploit \u2014 RegPwn (CVE-2026-24291)\n\u2694\ufe0f Registry Symlink Privilege Escalation via Accessibility Mechanism\n\n\ud83d\udccc Research / Blog\n\ud83d\udc49https://www.mdsec.co.uk/2026/03/rip-regpwn/\n\n\ud83d\udccc GitHub (Exploit)\n\ud83d\udc49https://github.com/mdsecactivebreach/RegPwn\n\n\ud83d\udccc GitHub (BOF / Cobalt Strike)\n\ud83d\udc49https://github.com/Flangvik/RegPwnBOF\n\n\ud83d\udcd6 Description\nRegPwn is a Local Privilege Escalation (LPE) vulnerability in Windows\naffecting Windows 10, Windows 11, and multiple Windows Server versions.\n\nIt was discovered and used internally by MDSec during Red Team operations\nsince early 2025, and later patched in March 2026.\n\nTracked as:\n\ud83d\udc49 CVE-2026-24291\n\n\u2699\ufe0f Vulnerability Overview\nThe issue exists in the Windows Accessibility (ATBroker / ATConfig) mechanism.\nMisconfigured registry permissions\nUser-controlled registry data copied into privileged context\nWritable HKLM registry path exposed to low-priv users\n\ud83d\udc49 Leads to arbitrary registry write as SYSTEM\nAccording to CVE:\nIncorrect permission assignment allows local privilege escalation\n\n\ud83e\udde0 Exploitation Concept\nRegistry Flow Abuse\nHKCU (User Controlled)\n        \u2193\nHKLM Session Key (Writable)\n        \u2193\nHKU\\.DEFAULT (SYSTEM Context)\n        \u2193\nSYSTEM Process Execution\n\nCore Technique\n\u2022 Registry Symlink Abuse\n\u2022 Race Condition (Oplock)\n\u2022 Accessibility Feature Trigger (osk.exe)\n\ud83d\udc49 Result:\nLow Priv User \u2192 SYSTEM Privilege\n\n\u2694\ufe0f Exploit Details\nThe exploit abuses:\n\u2022 Accessibility configuration registry keys\n\u2022 Secure Desktop behavior\n\u2022 ATbroker.exe interaction\n\u2022 osk.exe execution timing\n\ud83d\udc49 By combining:\n\u2022 Opportunistic Lock (Oplock)\n\u2022 Registry Symbolic Link\nAn attacker can redirect writes to arbitrary SYSTEM registry locations\n\n\ud83d\udca3 Practical Impact\n\u2022 Local Privilege Escalation (LPE)\n\u2022 Full SYSTEM access\n\u2022 Service ImagePath hijacking\n\u2022 Payload execution as SYSTEM\n\n\ud83e\uddec GitHub \u2014 Exploit Implementation\n\u2699\ufe0f RegPwn (Original Exploit)\n\u2022 Language: C#\n\u2022 Targets:\n   \u2022 Windows 10 / 11\n   \u2022 Windows Server 2016 / 2019 / 2022\n   \u2022 Based on blog research\n\ud83d\udc49 Direct PoC for LPE\n\n\u2694\ufe0f RegPwnBOF (Cobalt Strike BOF)\n\u2022 BOF implementation of exploit\n\u2022 Designed for post-exploitation use\n\u2022 Supports:\nbeacon> regpwn payload.exe\n\ud83d\udc49 Enables SYSTEM escalation inside C2 operations\n\n\ud83e\udde0 Red Team Insight\nReal-World Usage Flow\nInitial Access\n     \u2193\nBeacon / Agent\n     \u2193\nRegPwn Execution\n     \u2193\nSYSTEM Privilege\n     \u2193\nLateral Movement / Persistence\n\nWhy This Matters\n\u2714\ufe0f Works on multiple Windows versions\n\u2714\ufe0f Reliable LPE vector\n\u2714\ufe0f BOF integration available\n\u2714\ufe0f Useful for post-exploitation chains\n\n\ud83d\ude80 Key Takeaways\n\u2022 Accessibility features can expose privileged pathways\n\u2022 Registry permission misconfig = critical attack surface\n\u2022 Race conditions + symlink = powerful LPE combo\n\u2022 Direct integration into C2 frameworks\n\n\u26a0\ufe0f Patch Status\n\u2714\ufe0f Fixed in March 2026 Patch Tuesday\n\u2714\ufe0f Affects pre-patch Windows environments\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:06.412537Z"}