CVE-2020-1472

复现完了有点小BUG，重启后会卡在登录页面比较久。不知道是不是只有我会。谨慎在真实环境利用 实战中可以使用secretsdump.py 的 -use-vss和-history获取历史hash进行恢复. 第一步 pip3 install -r requirements.txt 查看hash secretsdump.py molecule-labs.com/administrator:[email protected] -just-dc-user 'AD$' 攻击 python3 CVE-2020-1472.py AD AD$ 192.168.175.132 查询域控hash...

dconstruct

dconstruct 打开源 MP4 dconstruct 是一款用于《最后生还者 第二部》DC-Script 文件的逆向工程工具。它包含反汇编器和反编译器。 工具输出 .asm 文件（包含反汇编出的结构与字节码）以及 .dcpl（DC 伪语言）文件（包含类似 C 语言风格的伪代码）。 你也可以通过命令行对文件进行编辑，包括轻松替换整个结构。这使得创建仅需修改 .bin 文件中少量数值的 mod 变得极其简单。 主要特性 速度优化。反汇编与反编译速度极快。 对原始源代码（尤其是控制流）的精确重构。 对反汇编中所有结构的精确自动解析。 同时反汇编与反编译多个文件。反编译游戏中每一个 .bi...

CVE-2026-22094

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

CVE-2026-22094

The firmware for the EVbee DC-80 contains a weak hardcoded root password . This vulnerability allows an attacker to gain root access by authenticating through the SSH daemon , which is exposed to the network. No specific remediation or exploit details are provided in the documents.

EUVD-2026-88973

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-87748

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2...

EUVD-2026-88744

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2...

CVE-2026-87748 Privilege Escalation via Account Takeover in Interprobe's Qorela DC

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2...

CVE-2026-87748

A Missing Authorization vulnerability exists in Interprobe Information Technologies Inc. Qorela DC affecting versions 1.6.1-RC29 through v1.6.2 . This flaw enables Privilege Abuse , allowing an attacker to escalate permissions. While the technical root cause is not detailed in the provided docume...

SharpPrivesc

SharpPrivesc Practicing C and bringing Privesc attack surfaces together. Still noob stuff. Privesc checks and the like. I preferred Spectreops command line parsing classes so decided to utilize theirs over other .net packages like command line parser etc. To-Do: Menu More Privesc Check modules...

CVE-2019-1040

CVE-2019-1040 很棒的文章！利用 CVE-2019-1040 - 结合中继漏洞实现 RCE 和域管理员权限 。 因此，我编写了 CVE-2019-1040.py 以便于使用。 你也可以查看我的 exchange2domain 仓库：https://github.com/ridter/exchange2domain，这是另一种利用 Exchange 获取域控制器的方法。 依赖 这些工具需要 impacket。你可以通过 pip install impacket 从 pip 安装。 用法 usage: CVE-2019-1040.py -h -u USERNAME -d DOMA...

DCSYNCMonitor

DCSYNCMonitor Descripción Esta herramienta es una aplicación/servicio que se puede implementar en controladores de dominio para alertar sobre intentos de sincronización de Controladores de Dominio. Cuando se detecta un intento, la herramienta escribe un evento en el Registro de Eventos de Windows...

dc-sonar

DC Sonar 社区 仓库 该项目包含以下仓库： dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer 免责声明 仅供教育目的使用。 请勿在生产环境中的 Active Directory AD 域下使用。 任何贡献者均不对其使用承担任何责任。 社交媒体 查看我们的红队社区 Telegram 频道 目录 1. 描述 1. 架构 2. 功能 2. 安装 1. Docker 2. 使用 dpkg 手动安装 3. 风格指南 4. 开发部署 1. Docker 2. 使用 Windows 宿主机...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Escalada de privilegios en Active Directory Certificate Services AD CS 👋 Descripción general CVE-2026-54121 "Certighost" es una vulnerabilidad de escalada de privilegios de alta gravedad que afecta a Microsoft Active Directory Certificate Services AD CS. La...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "Penetration testing lab writeups documenting full attack chains — from recon to root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Difficulty: Beginner–Intermediate Platform: VulnHub Goal: Capture all 4 flags and achieve full root-level compromise Attacker OS: Kali Linux VirtualBox...

EIPP

Listas de Contraseñas Prohibidas de EIPP Herramientas para manipular Listas de Contraseñas Prohibidas BPL de Entra ID Password Protection. El archivo eipp-global-bpl.txt que contiene las entradas de la lista global de contraseñas prohibidas fue volcado el 2024-04-11. Más información en...

PoC-CVE-2020-9715

CVE-2020-9715 Prueba de concepto de validación de EDR Use-after-free en el caché de ESObject de EScript.api de Adobe Acrobat Reader DC. Solo para pruebas autorizadas de EDR por equipos rojos. Vulnerabilidad Adobe Acrobat Reader DC = 2020.009.20063. El motor EScript almacena en caché objetos...