SharpSuccessor

SharpSuccessor SharpSuccessor 是一个 .NET 概念验证（POC），用于全面武器化 Yuval Gordon（@YuG0rd）在 Akamai 提出的 BadSuccessor 攻击。低权限用户只要拥有对 Active Directory 域中任意组织单位（OU）的 CreateChild 权限，并且对目标对象具有写访问权限，就可以执行账户接管。 使用 SharpSuccessor 添加并武器化 dMSA 对象，同时在您希望冒充的目标账户上写入正确的属性： root@kitploit: SharpSuccessor.exe add...

Invoke-BadSuccessor.ps1

Invoke-BadSuccessor 滥用委派托管服务帐户 dMSA 在易受攻击的组织单位 OU 上的创建权限，以在 Active Directory 环境中提升权限（BadSuccessor 漏洞 – CVE-2025-53779）。 概述 Invoke-BadSuccessor 通过利用 Windows Server 2025 Active Directory 中的 dMSA 错误配置和委派，自动化特权提升攻击链： 识别当前用户（或其组）拥有 CreateChild 权限的 OU。 创建或重用计算机帐户 。 创建或重用委派托管服务帐户 dMSA 。 授予用户对 dMSA 的...

OS Command Injection

priest-runner is vulnerable to OS command injection. The vulnerability exists as it passes unsanitized input into a spawn call through a POST request into PriestController.prototype.createChild...

Command Injection in priest-runner

All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the spawn...

Command Injection

Overview All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the...