sharlot sticks-stuff

Exploit Title: Tungsten Automation - Kofax Capture Unauthenticated File Read/Write and SMB coercion via .NET HTTP Remoting

Disclosure Date: 4/23/2026

CVE ID: CVE-2026-23751

Exploit Authors: Victor A. Morales of GM Sectec, Corp.

Vendor Homepage: https://docshield.tungstenautomation.com/Portal/Products/en_US/KC/11.1.0-40hy9nfk91/KC.htm

Known Affected Versions: 6.0.0.0

Description

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service (C:\Kofax\CaptureSS\ServLib\Bin\ACSvc.exe) that is accessible without authentication and uses a default, publicly known endpoint identifier. By modifying the PoC of Code-White's RemotingClient_MBRO_Lazy.exe program to implement a custom channel sink to redirect .NET Remoting traffic to the correct host, an unauthenticated remote attacker can exploit .NET Remoting object unma

After spending days following some obsolete or incomplete or just too long and specific guides, here is my take on setting up a Wii in the year 2020

Format SD card with 1 partition of 32kb clusters: sudo mkdosfs /dev/sdXX -s 128 -F 32. Up to 32GB SD-HC should work fine, despite what was said in old forums
Install BootMii + HBC with LetterBomb: https://wiibrew.org/wiki/LetterBomb
BACKUP your NAND with BootMii to be safe from bricking: https://sites.google.com/site/completesg/how-to-use/bootmii This is mostly for peace of mind though
Install cIOS 249 base 56 v10 beta52 on slot 249 and base 57 on slot 250. This is the most complex step, be careful to follow the instructions here: https://sites.google.com/site/completesg/backup-launchers/installation

	AACustomByteStreamOpen
	AAEntryACLBlob
	AAEntryXATBlob
	AAFieldKeySetGetKeyCount
	AAHeaderGetKeyIndex
	ABMultiValueGetCount
	ABPersonViewController
	ADCommonDefinitions
	ADErrorAdUnloaded
	ADErrorLoadingThrottled

	#replace "<PAT TOKEN>" with your github PAT token, tested with "Update ALL user data" PAT token.

	curl -q https://rms-support-letter.github.io/ \| grep "href" \| grep "github.com" \| grep -v "\/\[" \| awk -F "https://github.com/" '{ print $2 }' \| awk -F "\"\>" '{ print $1 }' \| sed 's/\///g' \| sed '/^$/d' \| xargs -I USER curl -i -X PUT -H "Authorization: token <pat token here>" -H "Accept: application/vnd.github.v3+json" https://api.github.com/user/blocks/USER