ADCSPwn

ADCSPwn A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts Petitpotam and relaying to the certificate service. Usage Run ADCSPwn on your target network. root@kitploit: Author: @batsec - MDSec ActiveBreach Contributor: @Flangvik - TrustedSec...

SharpSCCM

Tool Overview SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager a.k.a. ConfigMgr, formerly SCCM for lateral movement and credential gathering without requiring access to the SCCM administration console GUI. SharpSCCM was initially created to execu...

CVE-2025-54918-POC

CVE-2025-54918 – Proof of Concept PoC ⚠️ Important Notice IMPORTANT: To test CVE-2025-54918 , you must create a DNS record in the target Active Directory environment. Always consult with the client and obtain explicit authorization before testing, as this can impact DNS and authentication behavior...

relay_bible

Relay Bible — Internal Penetration Testing Relay Guide A comprehensive reference for NTLM relay attacks during authorized internal penetration tests. Covers authentication fundamentals, coercion techniques, per-protocol relay targets, tooling, advanced chaining, and defensive mitigations...

Ivanti-EPM-Coercion-Vulnerabilities

Ivanti EPM Coercion Vulnerabilities Proof of concept exploits for Ivanti EPM CVE-2024-13159 and others which allows for unauthenticated coercion of the Ivanti EPM machine credential for use in relay attacks. Blog Post Deep-dive analysis here:...

UnCanny

UNCanny Coerce The idea behind this research was simple as i wanted to find my own coercion technique. i started by looking for new RPC attack surfaces, but after microsoft added RPC activity monitoring...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through many methods. Windows Support To build a binary for Windows, download the installer.ps1 script from this repository. Run it simply with no arguments to create a binary in the working directory...

PetitPotam

PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...

RAITrigger

RAITrigger La función RPC RAiForceElevationPromptForCOM de la biblioteca appinfo.dll permite la coerción de SYSTEM. Esto solo funciona en sistemas unidos a un dominio. Resulta que esta función puede ser llamada por cualquier usuario con bajos privilegios no para lanzar un proceso sino para provoc...

json-sanitizer

json-sanitizer 给定类似JSON的内容，JSON Sanitizer 会将其转换为有效的JSON。 入门 - 联系方式 它可以附加在数据管道的任一端，以帮助满足Postel原则： 在自己做什么时要保守，在接受别人给予时要开放 应用于来自他人的类似JSON的内容时，它会生成格式良好的JSON，应能满足您使用的任何解析器。 在发送之前应用于您的输出时，它会纠正编码中的小错误，并使您的JSON更易于嵌入HTML和XML。 动机 许多应用程序有大量代码使用临时方法生成JSON输出。...

CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

EUVD-2026-72384

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass in its REST API caused by MySQL type coercion : unauthenticated attackers can send small integers (0–9) instead of string tokens, allowing them to match token hashes and access protected endpoints. Successful exploitation exposes device cre...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

cupntlm-Automated-Exploit-For-CVE-2025-33073-

cupntlm CVE-2025-33073 — Bypass de reflexión NTLM mediante coerción DNS Herramienta de explotación automatizada para entornos de Active Directory. Descripción general cupntlm automatiza la cadena de ataque de reflexión/retransmisión NTLM que abusa de CVE-2025-33073. Combina la inyección de...

PT-2026-86792

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

windows-coerced-authentication-methods

本仓库收录了多种强制 Windows 机器向攻击者控制的机器进行身份验证的方法。 所有这些方法都可以由域中的标准用户调用，以强制目标 Windows 机器（通常是域控制器）的机器账户向任意目标进行身份验证。这些方法中每个“漏洞/特性”的根本原因在于：Windows 机器在尝试访问 UNC 路径（如 \192.168.2.1\SYSVOL\file.txt）时，会自动向其他机器进行身份验证。 目前共有 15 个可用函数，涵盖 5 种协议。 !NOTE 🎉 还有许多新方法有待测试，如果你想尝试它们：possible-working-calls...