PSPKIAudit

PSPKIAudit PowerShell toolkit for auditing Active Directory Certificate Services AD CS. It is built on top of PKISolution's PSPKI toolkit Microsoft Public License. This repo contains a newer version of PSPKI than what's available in the PSGallery see the PSPKI directory. Vadims Podans the creator...

Certi-Bhai

Certi-Bhai: AD CS エクスプロイトツールキット Certi-Bhaiは、Active Directory 証明書サービス（AD CS）の脆弱性を攻撃するためのPowerShellエクスプロイトツールの包括的なコレクションです。このツールキットは、ADCS環境における重大なセキュリティ設定ミスを実証するさまざまなエスカレーションシナリオ（ESC）を実装しています。 📋 目次 概要 ディレクトリ構造 前提条件 使用方法 ESC1 - 過度に寛容な証明書テンプレート ESC2/3 - 証明書要求エージェント ESC15 - 脆弱なWeb登録 CSR生成 IIS権限昇格 🎯 概要...

TryHackMe-CVE-2022-26923

TryHackMe-CVE-2022-26923 CVE-2022-26923 の悪用に関するウォークスルー。AD 証明書サービスの脆弱性です。 CVE-2022-26923 TryHackMe | CVE-2022-26923 タスク 1 はじめに セキュリティ更新プログラム ガイド - Microsoft セキュリティ レスポンス センター TryHackMe | Active Directory の基礎 Certified Pre-Owned. Active Directory Certificate Services… | Will Schroeder 著 | SpecterOp...

CVE-2022-26923-Powershell-POC

CVE-2022-26923-Powershell-POC 메모리에서 Certify와 Rubeus를 로드하고 자동으로 실행하는 PowerShell POC입니다. 작동 방식 1. Certify.exe와 Rubeus.exe를 메모리에 로드합니다. 2. 대상 머신에서 잘못 구성된 인증서 템플릿을 검색합니다. 자세한 내용: https://www.youtube.com/watch?v=HBRCI5O35R8 3. 취약한 템플릿을 기반으로 관리자Administrative 사용자에 대한 인증서를 요청합니다. 4. 인증서를 인증서 핸들러로 보내면 .p...

AD/CS Authenticated Web Enrollment Services Module

Authenticates to the AD/CS Web enrollment service and allows the user to query templates and create certificates based on available templates. Module Options msf use auxiliary/admin/http/webenrollmentcert msf auxiliarywebenrollmentcert show actions ...actions... msf auxiliarywebenrollmentcert set...

SUSE CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet's certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

GHSA-5JVP-M9H4-253H Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Summary A broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Impact Fleet supports certificate templates that are scoped to individual teams. In affected...

Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Summary A broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Impact Fleet supports certificate templates that are scoped to individual teams. In affected...

EUVD-2026-8828

Fleet: Authorization Bypass in certificate template batch deletion for team administrators...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the certificate template batch deletion process. An attacker can remove certificate templates belonging to other teams by supplying arbitrary team identifiers and template IDs to the API endpoint...

CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963 Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963

Fleet is an open source device management platform. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could let a team administrator delete certificate templates belonging to other teams within the same Fleet instance. The affected flow validat...

CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963 Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963 Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

PT-2026-22116

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1 Description Fleet’s certificate template deletion API had a broken authorization check. This allowed a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. T...

Metasploit Wrap-Up 08/01/2025

ESC support in Metasploit This week, we're excited to announce that Metasploit users can now detect certificate templates vulnerable to ESC9, ESC10, and ESC16 using the existing ldapescvulnerabletemplate module. In addition, users can now exploit these vulnerable templates with the brand new...

Misconfigured Certificate Template Finder

class MetasploitModule 'Misconfigured Certificate Template Finder', 'Description' = %q This module allows users to query a LDAP server for vulnerable certificate templates and will print these certificates out in a table along with which attack they are vulnerable to and the SIDs that can be used...