Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a vulnerability in the Windows Netlogon service that allows an attacker to authenticate as the domain controller account with a zero-length password. The exploit uses the impacket library to connect to the Netlogon service and send a zero-length challenge and...

PT-2025-32855

Name of the Vulnerable Software and Affected Versions Windows versions prior to August 2025 Patch Tuesday Description A relative path traversal vulnerability exists in the Windows Kerberos implementation. This flaw allows an authorized attacker to elevate privileges on a network. The vulnerabilit...

The vulnerability of the centralized system for managing user identities in FreeIPA, related to improper access control, allows a perpetrator to elevate their privileges to the level of domain administrator and affect the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the centralized system for managing user identities in FreeIPA is related to improper access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to elevate their privileges to the level of domain administrator and affect the...

ROS-20250729-07

A vulnerability in FreeIPA's centralized user identity management system is related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges to the level of a domain administrator and impact the domain. remotely, escalate the...

ROS-20250729-06

A vulnerability in FreeIPA's centralized user identity management system is related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges to the level of a domain administrator and impact the domain. remotely, escalate the...

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

PT-2025-34: Privilege escalation from host to domain admin in FreeIPA

The vulnerability was identified in FreeIPA, versions to 4.12.4. The discovered vulnerability allows an attacker to retrieve a Kerberos ticket for domain admin. The vulnerability allows an attacker to access and exfiltrate sensitive data. Vulnerability status: Confirmed by vendor Date of...

CVE-2025-20656

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423...

CVE-2020-9002

An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANYADMIN to UserRoleKey=DOMAINADMIN to achieve Domain Administrator access...

Investigating a SharePoint Compromise: IR Tales from the Field

Executive summary Rapid7’s Incident Response team recently investigated a Microsoft Exchange service account with domain administrator privileges. Our investigation uncovered an attacker who accessed a server without authorization and moved laterally across the network, compromising the entire...

BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure', 'Description' = %q This module exploits a...

SolarWinds Access Rights Manager Authorization Issues Vulnerability

SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. An authorization issue vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to gain domain administrator access...

SolarWinds Access Rights Manager 授权问题漏洞

SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. An authorization issue vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to gain domain administrator access...

Exploit for CVE-2021-42278

This is a Python script for exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate a Domain Administrator DA from a standard domain user. The script uses the Impacket library to interact with the Active Directory. The script has several components: 1. samtheadmin.py: This is the main script...

Exploit for CVE-2021-42278

This is a PoC exploit for CVE-2021-42278 and CVE-2021-42287, which are two vulnerabilities in the Windows operating system that allow an attacker to impersonate a Domain Administrator DA from a standard domain user. The exploit uses the Impacket library to interact with the Windows Domain...

CVE-2023-52269: Improper Neutralization of Input During Web Page Generation

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators...

CVE-2022–26923 aka Certifried

Active Directory Domain Services Elevation of Privilege Vulnerability. Recent assessments: cdelafuente-r7 at January 10, 2023 3:08pm UTC reported: This vulnerability enables a low-privileged user to escalate privileges in a default Active Directory environment with the Active Directory Certificat...

Microsoft Azure HDInsight Apache Ambari Elevation of Privilege Vulnerability

Microsoft Azure is a set of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. An elevation of privilege vulnerability exists in Microsoft Azure HDInsight Apache Ambari, which can be exploited by an attacker to gain domain administrator privileges...