445 matches found
SharpMove
SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath SharpMove.exe action=query...
CrystalPotato
CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...
DCOMIllusionist
š©āØšŖ DCOMIllusionist Windows fileless lateral movement technique. Introduction ā¢ Build ā¢ Usage ā¢ Technical Details ā¢ Acknowledgements Introduction This tool enables remote code execution on a Windows machine, if you have administrative privileges. It leverages DCOM and the behavior of .NET DCOM...
ADCSDevilCOM
ADCSDevilCOM A C tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly. !WARNING Use only in...
CobaltStrike-BOF
CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...
RemoteKrbRelay
//, ,//\ \ / \ \ XXX XXX / //, \o-o/-o-o/ / / \ XXX | / \ / ,-/ / \ / /,| | \ | / \ / ,-,,,/ ,,, CICADA8 Research Team From Michael Zhmaylo MzHmO RemoteKrbRelay You probably know KrbRelay and KrbRelayUp, but what if I told you it could be done remotely? With RemoteKrbRelay this becomes a...
ExploitDotNetDCOM
ExploitDotNetDCOM c James Forshaw 2014 A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET. For information purposes only. All code is licensed under GPLv3...
DVS
DCOM Vulnerability Scanner AKA Devious swiss army knife - Lateral movement using DCOM Objects Did you ever wonder how you can move laterally through internal networks? or interact with remote machines without alerting EDRs? Let's assume that we have a valid credentials, or an active session with...
DCOMrade
DCOMrade DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script...
CPLDCOMTrigger
CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...
CPLDCOMTrigger
CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...
MiscTools
MiscTools CsExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context of a privileged user. CsExec.exe Also see TikiService. CsPosh Command Exec / Lateral Movement via PowerShell. Creates a PowerShell runspace on a remote target. Must be running in the...
RemotePotato0
RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...
GodPotato
GodPotato Based on the history of Potato privilege escalation for 6 years, from the beginning of RottenPotato to the end of JuicyPotatoNG, I discovered a new technology by researching DCOM, which enables privilege escalation in Windows 2012 - Windows 2022, now as long as you have...
Kernelhub
CVE-2003-0352 Describe Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. ImpactVersion Product| C...
dcomhijack
DCOM DLL Hijacking We recently discovered the following DCOM classes that are subject to DLL hijacking. If an attacker can write to the associated path, they can move laterally by instantiating the COM object. Some classes have additional DLL hijacking opportunities that are not listed here. Clas...
DCOMUploadExec
DCOM Upload & Execute DCOM Lateral movement POC abusing the IMsiServer interface https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor The solution contains 2 projects DCOMUploadExec - A C++ project which hosts the lateral movement attack code AssemblyPayload - A .NET DLL...
RemoteMonologue
RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...
DLHell
DLHell DLHell performs DCOM local & remote Windows DLL Proxying. Install The following packages are required might depend on your distro, the following example is for Debian 12: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Install pip dependencies: pip3 install -r...
RemoteMonologue
RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...