Microsoft Windows Update Orchestrator Unchecked ScheduleWork Call
Posted by deepcore on September 29, 2020 – 12:45 pm
This Metasploit module exploit uses access to the UniversalOrchestrator ScheduleWork API call which does not verify the caller’s token before scheduling a job to be run as SYSTEM. You cannot schedule something in a given time, so the payload will execute as system sometime in the next 24 hours.
Post a reply
You must be logged in to post a comment.