kekeo

kekeo kekeo is a little toolbox I have started to manipulate Microsoft Kerberos in C and for fun ASN.1 library In kekeo, I use an external commercial library to deal with Kerberos ASN.1 structures: OSS ASN.1/C http://www.oss.com/asn1/products/asn1-c/asn1-c.html It was the only code...

EUVD-2026-73623

Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network...

CVE-2026-69760

Windows Kerberos is affected by an out-of-bounds read vulnerability that allows an unauthorized, unauthenticated attacker to trigger a denial of service over the network. The vulnerability is rated CVSS 7.5 (HIGH) with a low attack complexity and no user interaction required. CISA's SSVC assessme...

CVE-2026-69685

Windows Kerberos is affected by a heap-based buffer overflow that allows an authorized attacker to locally elevate privileges . Per Microsoft, the vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, low privileges required, and no user interaction, res...

EUVD-2026-73573

Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally...

EUVD-2026-73071

Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...

CVE-2026-69676

CVE-2026-69676 is an authentication bypass by capture-replay vulnerability in Windows Kerberos that allows an authorized attacker to achieve remote code execution over a network. The underlying mechanism involves replaying captured Kerberos authentication traffic, enabling privilege escalation be...

EUVD-2026-73065

Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally...

CVE-2026-69822

CVE-2026-69822 is a local privilege escalation vulnerability in Windows Kerberos caused by a numeric truncation error . An authorized attacker with low privileges can exploit this to achieve full confidentiality, integrity, and availability impact (CVSS 3.1: 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/...

EUVD-2026-73054

Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network...

CVE-2026-69744

Windows Kerberos is affected by a null pointer dereference that allows an unauthenticated attacker to trigger a denial of service over a network . The CVSS 3.1 score is 7.5 (HIGH) , with the vector indicating low attack complexity, no privileges required, and no user interaction. The primary impa...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

mimikatz

mimikatz mimikatz 是我为了学习 C 语言并对 Windows 安全进行一些实验而制作的一款工具。 如今它以从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据而闻名。mimikatz 还可以执行哈希传递（pass-the-hash）、票据传递（pass-the-ticket）或构建黄金票据（Golden tickets）。 root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin DELPY...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

Prox-Ez

Prox-Ez: La navaja suiza de la autenticación HTTP Este proxy HTTP gestiona todas las autenticaciones HTTP en tu nombre. Es compatible con NTLM EPA enlace de canal y enlace de servicio, kerberos, pass-the-hash, overpass-the-hash pass-the-key y pass-the-ticket TGT y TGS. Artículos relacionados:...

DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

Wonka

Wonka 🍫 "We are the music makers, and we are the dreamers of dreams." - Willy Wonka Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority LSA cache. Like finding a ticket, but for security research and penetration testing! 🎫 ✨ Features 🔐 System...

tgt-monitor-bof

Kerberos TGT Monitoring & Auto-Renewal This repository contains two Async Beacon Object Files BOF. The first, tgt-monitor, monitors the system for Kerberos logon events and wakes up the agent whenever a new Kerberos TGT is captured. Similar to Rubeus' monitor command, this BOF is running...