References https://avd.aliyun.com/detail?id=AVD-2024-21447 https://avd.aliyun.com/detail?id=AVD-2024-29056 https://support.microsoft.com/zh-cn/topic/windows-server-2008-%E4%B8%AD-windows-%E7%89%B9%E6%9D%83%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%AE%89%E5%85%A8%E6%9B%B4%E6%96%B0-2017-%E5%B9%B4-7-%E6%9C%88-11-%E6%97%A5-f102d292-7df5-ccc7-56fb-4aa627b11874 https://www.venustech.com.cn/new_type/aqtg/20230614/25758.html https://www.sohu.com/a/771731241_121334619 https://support.huaweicloud.com/intl/zh-cn/bestpractice-hss2.0/hss_06_0023.html https://www.cnblogs.com/kqdssheng/p/18738762 https://whoamianony.top/posts/certifried-active-directory-domain-privilege-escalation/ https://www.uniforce.com.tw/edcontent_d.php?lang=tw&tb=1&id=1566 https://cn.t00ls.com/articles-75143.html
Related VulnerabilitiesWindows截图工具NTLM信息泄露漏洞(CVE-2026-33829)Gradio /static//windows/win.ini 文件读取漏洞 (CVE-2026-28414)Windows Shell Link 敏感信息泄露与欺骗漏洞(CVE-2026-25185)PoCCVE-2025-13315: Twonky Server 8.5.2 on Linux and Windows - Log File ExposureWindows PolicyConfiguration 计划任务特权提升漏洞(CVE-2025-60710)Windows 11 PolicyConfiguration 计划任务特权提升漏洞(CVE-2025-60710)Windows 11 RAiLaunchAdminProcess 管理员保护特权提升漏洞(CVE-2025-62522)Vite开发服务器Windows环境下文件泄露漏洞(CVE-2025-41246) VMware Tools for Windows授权不当漏洞Windows NTLMv2-SSP Hash信息泄露漏洞(CVE-2025-50154)(CVE-2025-26513)SAN Host Utilities for Windows 8.0前版本安装程序本地权限提升漏洞(CVE-2025-8088) WinRAR Windows版本路径遍历漏洞可导致任意代码执行PoCCVE-2015-1635: Microsoft Windows 'HTTP.sys' - Remote Code Execution