Ruben Labs

Security Researcher

[Ruben Labs @RubenLabs]

New XSS2RCE in Azure Windows Admin Center!

I am happy to share our latest findings, CVE-2026-32196, a critical unauthenticated vulnerability allowing one-click remote code execution.

An attacker can craft a malicious legitimate gateway URL that, when visited by a privileged Azure admin, triggers a response-based XSS in WAC’s error handling.

This results in JavaScript execution under the WAC origin, which translates to arbitrary PowerShell execution on every managed server the victim has access to (no credentials required).

On on-premises deployments, the same chain allows theft of Azure access and refresh tokens from local storage, enabling full tenant impersonation and lateral movement into EntraID and Azure.

Full blog:

https://t.co/wt6MV0qFY1

[Ruben Labs @RubenLabs]

That is exactly the Microsoft @msftsecresponse silent patch, which isn’t enough, and without a proper CVE.

Instead of a single « open photos » prompt they added another one asking if the server is trusted.

I am now working on reporting to @googlechrome @firefox and @brave to understand what steps they will take to patch it, since when a browser allows such behaviours it exposes users to a CWE-939 (Improper Authorization in Handler for Custom URL Scheme) and a CWE-668 (exposure of resources to the wrong sphere) vulnerabilities.

I will write a new blog post to publish their response.

[Ruben Labs @RubenLabs]

I found a new one click NTLM leakage vulnerability / technique from a browser.

A web server can redirect a client to a ms-photos URI handler followed by a fileName parameter. If the parameter value is a UNC path instead of a local path, photos.exe will leak the client’s NTLMv2-SSP hash, enabling relay attacks or offline cracking.

Leaking hashes from URI handlers is not new, but combined with a browser redirection, it allows moving from website infection to capturing NTLMv2-SSP hashes (supply chain attack).

No LLMNR is required, and except if the firewall blocks outbound SMB queries, the hash will leak to public facing SMB servers.
The vulnerability can be combined in a supply-chain attack, by infecting public facing applications.

MSRC will not release a patch for this issue.

Find more details with a POC here:

https://t.co/2gMKtGZfQt

[BriPwn @BriPwn]

@RubenLabs FYI just did a Weekly Purple Team episode on your NTLMv2 zero day. https://t.co/zJxi8Hyaks Check it out!

[Ruben Labs @RubenLabs]

@BriPwn Excellent video explaining the vulnerability! Nice work!

[Ruben Labs @RubenLabs]

Read my new blog about blockchain EtherHiding here

[Ruben Labs @RubenLabs]

Is Web3 the new C2?

Read my blog about EtherHiding, an emerging method that abuses public blockchains as malware infrastructures by embedding payloads into smart contracts.

It provides attackers with decentralized payloads evading takedown & defense.

https://t.co/u5NzaqpA4h

[Ruben Labs @RubenLabs]

Is Web3 the new C2?

Read my blog about EtherHiding, an emerging method that abuses public blockchains as malware infrastructures by embedding payloads into smart contracts.

It provides attackers with decentralized payloads evading takedown & defense.

https://t.co/u5NzaqpA4h

[Ruben Labs @RubenLabs]

@pfiatde You are welcome!

I’ll try it soon on a VPS and post an update here. I think that it’ll work anyway.

[Ruben Labs @RubenLabs]

@davidnaliay Thank you!

Interesting try, but it contradicts the term “local link” in LLMNR. The RFC 4695 itself (see 2.6/b) says:

“If an IPv4 address is returned, it MUST be reachable through the link over which LLMNR is used.”

[Ruben Labs @RubenLabs]

On intranet also, Microsoft Word remote templates containing macros are blocked by MOTW.

I found a way to bypass it using LLMNR poisoning.

Not my greatest finding but useful for phishing assessment.

MSRC didn’t recognise it.

Details and POC:

https://t.co/hgNFSW2evc

[Ruben Labs @RubenLabs]

Microsoft patch for our last report - CVE-2025-50154 completely failed and the vulnerability remained unfixed.

Thanks to @0patch for the quick finding and report!

We reported this serious oversight, now tracked as CVE-2025-59214.

Full details: https://t.co/5eO72lAu6B

[Ruben Labs @RubenLabs]

@lapinousexy Yeah, but they thought they fixed it with CVE-2025-24054, but in fact they didn’t! That’s exactly why I reported it.

Thank you for the precision!

[Ruben Labs @RubenLabs]

Find the POC for my new finding, CVE-2025-50154, a zero day vulnerability on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch.

https://t.co/JKA8zuyYnl

[Ruben Labs @RubenLabs]

@lapinousexy Yes it is precisely!

With CVE-2025-24054 patch, I thought that what you sent shouldn’t work anymore. But in fact it does.

The reason is that the patch of Microsoft didn’t focus on target path value but on icon path value, blocking only there UNC paths.

[Ruben Labs @RubenLabs]

You didn’t click, but your password challenge is leaked.

I’m excited to share my latest research: CVE-2025-50154, a high severity NTLM hash disclosure vulnerability in the explorer.exe process, exploitable without any user interaction.

https://t.co/ssA9YdBE6J

[Ruben Labs @RubenLabs]

@Dinosn Thank you for sharing my findings @Dinosn !

Read more about it in my blog

[Ruben Labs @RubenLabs]

Happy to share my newly discovered vulnerabilities on Microsoft Windows!

- Credentials based UAC bypass, allowing to bypass the highest level
- Task Metadata Poisoning
- Task Event Log Buffer Overflow
- Unprivileged Security Logs Saturation

https://t.co/yAea6QuqG5

[Ruben Labs @RubenLabs]

@fortraofficial impacket-atexec script can be updated to run commands and overflow the whole content of the 4698 "task created" log, making command and arguments logs unwritable.

Also, logs and task metadata poisoning work remotely using the same method!

[Ruben Labs @RubenLabs]

Happy to share my newly discovered vulnerabilities on Microsoft Windows!

- Credentials based UAC bypass, allowing to bypass the highest level
- Task Metadata Poisoning
- Task Event Log Buffer Overflow
- Unprivileged Security Logs Saturation

https://t.co/yAea6QuqG5

[The Hacker News @TheHackersNews]

🔥 One task away from total takeover?

4 local privilege escalation flaws found in schtasks.exe—a core part of Windows Task Scheduler.

Attackers can:
• Bypass UAC
• Run SYSTEM-level commands
• Erase security logs
• Impersonate admins using known passwords.

Fix not yet available.

🔗 Full story → https://t.co/F2zZw80wWA