noPac

noPac CVE-2021-42287/CVE-2021-42278 Escáner y Explotador. Otra explotación de bajo esfuerzo para pasar de usuario de dominio a administrador de dominio. Si un Controlador de Dominio es vulnerable, devolverá un TGT sin PAC, todas las miradas en tickets de tamaño pequeño. Mitigación ¡Parchea tus...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

CVE-2020-1472

CVE-2020-1472 CVE 2020-1472 Script de validación Assumption: WinRM is enabled between domain controllers. Required permissions: If child domains are present: Enterprise admin If single forest, single domain: Domain admin This script must be run on a primary domain controller with required...

snare

SNARE Super Nueva generación Avanzado Reactivo honEypot Acerca de SNARE es un sensor honeypot de aplicaciones web que atrae todo tipo de maliciosidad de Internet. Documentación La documentación se puede encontrar aquí. Conceptos básicos Superficie primero. Centrarse en la generación de la...

CVE-2024-42642

CVE-2024-42642 Introduction The device in question is any MX500-series SSD. These SSDs are controlled by a Sillicon-Motion SM2259 controller older batches had an older controller, Sillicon-Motion SM2258, but the main focus of this document is the newer one. SM2259 is a 4-channel SATA 6Gb/s...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analice vulnerabilidades críticas de servicios de Windows Este repositorio proporciona herramientas para analizar y probar la vulnerabilidad de Netlogon conocida como CVE-2026-41089. Esta herramienta ayuda a los profesionales de seguridad a identificar si sus...

SCADAShutdownTool

SCADA Shutdown Tool Herramienta de pruebas de seguridad SCADA SCADAShutdownTool es una herramienta de automatización y prueba para sistemas de control industrial que permite a investigadores y expertos en seguridad probar sistemas de seguridad SCADA, enumerar controladores esclavos, leer los...

zerologon

CVE-2020-1472 일명 Zerologon Exploit POC 무엇인가? NetLogonMS-NRPC은 도메인 간 제어에 사용되는 취약한 보안 채널을 설정할 수 있습니다. 도메인 컨트롤러의 컴퓨터 계정 비밀번호를 0으로 초기화하는 것이 가능합니다. 참고 사항: DC는 비밀번호가 0으로 초기화되는 동안 반쯤 손상된 상태가 되지만, 이 프로그램은 작업이 끝나면 비밀번호를 다시 원래 값으로 변경합니다. DC에 DNS 문제가 발생할 수 있습니다재부팅으로 해결됨. Kerberos 티켓은 만료되기 전까지 10시간의 수명을 가집니다...

CVE-2025-1974

CVE-2025-1974 White Hat School 3rd Cohort - Kim So-eun @salt318 https://github.com/salt318/vulhub Summary Caused by a defect in the Ingress-NGINX Admission Controller, a core security mechanism of Kubernetes The Ingress-NGINX Admission Controller is exposed to the network without authentication...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation 👋 Overview CVE-2026-54121 "Certighost" is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services AD CS. The vulnerability allows an authenticated...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

CVE-2025-1974

CVE-2025-1974: Análisis de vulnerabilidad y configuración del entorno PoC para Kubernetes Ingress Nginx Controller Entorno de prueba MacOS M2 Ingress NGINX Controller 1.11.3 Rancher Desktop Docker Minikube Kubernetes Configuración del entorno de prueba local M2 MacOS Instalar minikube para las...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerabili...

S-V-Project-Implementation-of-CVE-2015-3256

CVE-2015-3456 VENOM — QEMU Crash PoC and Analysis This repository contains a reproducible crash/DoS proof-of-concept for CVE-2015-3456 "VENOM" using a vulnerable version of QEMU v2.3.0. The project demonstrates: Guest-controlled writes to the virtual floppy disk controller FDC Triggering the...

CVE-2023-5044

CVE-2023-5044 Poc for CVE 2023 5044 Prerequisites Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 PoC Give Docker the correct privileges sudo usermod -aG docker $USER && newgrp docker Start the cluster with extraPortMaping and node-labels to prepare it for an ingress. cat EOF | kind create cluster...

SecuraBV-CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

Zero-Logon-Exploit

ZeroLogon Exploit A Python script that uses the Impacket library to exploit Zerologon CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will currently change the password to a null value. When a domain controller is patched, the detection script will give up aft...

Zero-day-scanning

zeroscan Zeroscan es un escáner de vulnerabilidades de controladores de dominio, que actualmente incluye comprobaciones para Zerologon CVE-2020-1472, MS-PAR/MS-RPRN y SMBv2 Signing. CVE-2020-1472: Utiliza un script incorporado para comprobar Zerologon CVE-2020-1472, pero NO intenta explotar el...

windows-coerced-authentication-methods

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...