CVE-2025-61156

CVE-2025-61156 ThreatFire System Monitor（=v4.7.0.53）のカーネルモード TfSysMon.sys コンポーネントに、非特権ユーザーがカーネルモードの権限で任意のプロセス終了を実行できるようにする脆弱性が発見されました。その結果、PPL および保護されたシステムプロセスは強制的に停止される可能性があり、これにはアンチマルウェア、EDR ソリューション、エージェント型クライアントなどが含まれますが、これらに限定されません。これは、ローカルでの EDR Bypass と Denial of Service の両方を引き起こす可能性があります。...

aced

Aced Aced는 단일 대상 Active Directory 보안 주체의 DACL을 구문 분석하고 확인하는 도구입니다. Aced는 대상 계정에 대해 허용된 흥미로운 인바운드 액세스 권한을 식별하고, 인바운드 권한의 SIDS를 확인한 후 해당 데이터를 운영자에게 제공합니다. 또한 pyldapsearch의 로깅 기능이 Aced에 통합되어 대상 보안 주체의 LDAP 속성을 로컬에 기록하며, 이는 pyldapsearch의 동반 도구인 BOFHound에서 구문 분석하여 수집된 데이터를 BloodHound로 가져올 수 있습니다. 사용 사...

bofhound

THIS REPO IS NO LONGER ACTIVE ⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference https://github.com/coffeegist/bofhound 🚧⛔ root@kitploit: | / / / | /| | | | / \ | | | | | \ | | | \ | | | | | | | | | | || | | | | | | | | | | | | | .--. ...

Get-RBCD-Threaded

Get-RBCD-Threaded Active Directory 환경에서 리소스 기반 제한 위임RBCD 공격 경로를 찾는 도구 거의 전적으로 Elad Shamir의 훌륭한 블로그 게시물 "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory"와 harmj0y의 "A Case Study in Wagging the Dog: Computer Takeover"를 기반으로 합니다. 실제로 여기서 무슨 일이 일어나고 있는지 이해하고...

psexec_noinstall

psexecnoinstall このリポジトリには、忘れられたパイプを悪用するのに役立つ psexec が含まれています。 凡庸な管理者が PsExec を使用してホストに接続するようにします: これは、RemComCommunication バンドルを見たときに発見しました。これは PsExec では標準的なものです。 psexecnoinstall を使用すると、パイプの DACL がこれを許可しているため、任意の低権限ユーザーとしてこのパイプに接続できます。 チェッカーはこちら: https://github.com/beaverdreamer/nxc-modules...

Cable

Cable Cableは、Active Directory環境の偵察および随意アクセス制御リスト（DACL）に焦点を当てた悪用に使用されるポストエクスプロイテーションツールです。このツールは主に、Active Directoryコンテキストでの.NETオフェンシブ開発について学び、Active Directoryに焦点を当てたオフェンシブセキュリティに関する現在の知識と理解を広げるために作成されました。 使用方法 root@kitploit: |\ |\ |\ |\ \ |\ \ \ \ |\ \ |\ \ \ |\ /\ \ \ \ \ /| \ \ \ \ \ \ \ \ ...

WindowsDACLEnumProject

Windows DACL Enum Project Windows DACL を列挙・分析するためのツール群 NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.com/ 開発: Ollie Whitehouse ollie dot whitehouse at nccgroup dot com https://github.com/nccgroup/WindowsDACLEnumProject AGPL のもとで公開されています。詳細は LICENSE を参照してください。 Windows DACL と ACE の概要 参照 -...

CVE-2026-83991-writeup-and-poc

ファイルは拒否した。クラウドファイルは取って代わると言った。 CVE-2026-83991 は、Windows Cloud Files の改ざんに関する脆弱性であり、公開されている影響範囲は Windows 10 バージョン 1809 から始まり、2026 年 9 月の修正まで約 8 年間にわたります。 私は Windows にファイルを書き込み用に開くよう要求しました。返ってきたのは ERRORACCESSDENIED でした。 同じファイルの削除を要求しました。再び ERRORACCESSDENIED でした。 次に、Cloud Files...

CVE-2026-82312

A flaw was found in OpenVPN on Windows. A local authenticated user could exploit a vulnerability related to a NULL Discretionary Access Control List DACL on named Inter-Process Communication IPC objects. This could allow the user to cause a denial of service, making the service unavailable to...

CVE-2026-82312

OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...

CVE-2026-82312

OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows are vulnerable to a denial of service caused by a NULL DACL on named IPC objects . Local authenticated users can exploit this to disrupt service. The CVSS 4.0 base score is 1.8 (LOW) , with a local attack vector requiri...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a slab out-of-bounds write in smbinheritdacl. The slab out-of-bounds write occurs because the offsets are larger than the allocation size of pntsd. This patch adds a check to validate the three offsets using the...

CVE-2026-72382

A flaw was found in ksmbd in the Linux kernel. A remote attacker, by sending a specially crafted security descriptor with an undersized Discretionary Access Control List DACL during an SMB2SETINFO operation, can trigger an integer underflow. This underflow leads to excessive memory allocations fo...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

Linux Distros Unpatched Vulnerability : CVE-2026-72382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit i...

CVE-2026-68098

A flaw was found in ksmbd, a Linux kernel module. The setntacldacl function, which processes Discretionary Access Control Lists DACLs, can stop copying Access Control Entries ACEs prematurely due to a size accounting overflow. This can cause a subsequent deduplication process to read beyond the...

CVE-2026-68099

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

CVE-2026-68100

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

UBUNTU-CVE-2026-68099

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

CVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...