ADLab

AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analyze critical Windows service security vulnerabilities This repository provides tools to analyze and test the Netlogon vulnerability known as CVE-2026-41089. This tool helps security professionals identify if their Windows Domain Controllers face risks from this...

CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

CVE-2020-1472ZeroLogon 탐지 및 완화 데모 이 프로젝트는 ZeroLogon 이라고도 알려진 중요한 Windows 취약점인 CVE-2020-1472의 탐지 및 완화를 시연합니다. 이 취약점으로 인해 공격자는 인증 없이 관리자 액세스 권한을 얻을 수 있습니다. 본 프로젝트는 학교 사이버 보안 프로젝트의 일환으로 개발되었습니다. PoC 코드 크레딧은 Tom TervoortSecura에게 있으며, Suricata 규칙 세트 크레딧은 Proofpoint Emerging Threats에게 있습니다. 주요 구성 요소: P...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

CVE-2026-41089

🚨 CVE-2026-41089 - Critical Windows Netlogon Remote Code Execution RCE ⚠️ A critical Windows Netlogon vulnerability allowing unauthenticated remote code execution on domain controllers. 📖 Overview CVE-2026-41089 is a critical vulnerability affecting the Windows Netlogon service. The flaw originate...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation 👋 Overview CVE-2026-54121 "Certighost" is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services AD CS. The vulnerability allows an authenticated...

ntlm-scanner

New! Exploit Scan for CVE-2020-1472 ZeroLogon Scan DCs in your network to detect actual exploitation of CVE-2020-1472 Examples: root@kitploit: python scan.py -vuln CVE-2020-1472 -target-file targets.txt python scan.py -vuln CVE-2020-1472 -target Tool works by trying an empty password for DCs ever...

zer0dump

Zer0Dump Zer0dump is an PoC exploit/tool for abusing the vulnerabilities associated with CVE-2020-1472 Zerologon in order to initiate a full system takeover of an unpatched Windows domain controller. Special thanks to @dirkjanm and @SecureAuthCorp...

kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

CVE-2021-1675

From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 🚨 Patch released: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 The patch has been confirmed to fix RCE however local priviledge escalation appears to not be patched as of yet. Therefore...

DCSYNCMonitor

DCSYNCMonitor Описание Этот инструмент представляет собой приложение/службу, которое может быть развернуто на контроллерах домена для оповещения о попытках синхронизации контроллеров домена. При обнаружении попытки инструмент записывает событие в журнал событий Windows. Эти события могут быть...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

ZeroLogon-CVE-2020-1472-lab

ZeroLogon-CVE-2020-1472 Explanation and demonstration of the ZeroLogon CVE-2020-1472 vulnerability The purpose of this lab is strictly educational. Its execution is not recommended in production environments or those that do not belong to you. About the Vulnerability Context of the vulnerability...

Zero-day-scanning

zeroscan Zeroscan is a Domain Controller vulnerability scanner, that currently includes checks for Zerologon CVE-2020-1472, MS-PAR/MS-RPRN and SMBv2 Signing. CVE-2020-1472: Uses a built-in script to check for Zerologon CVE-2020-1472, but does NOT attempt to exploit the target, it is simply a...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...

windows-coerced-authentication-methods

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf — это инструмент для пентестинга / red-команд от Ed Williams , предназначенный для извлечения хэшей и учётных данных с рабочих...

Zerologon-Attack-CVE-2020-1472-POC

CVE-2020-1472 POC 최신 impacket이 필요합니다. GitHub에서 netlogon 구조체가 추가된 버전을 받으세요. 기본적으로 이 도구는 도메인 컨트롤러 계정의 비밀번호를 변경합니다. 물론 DCSync를 수행할 수 있지만, 다른 도메인 컨트롤러와의 통신을 끊어버리므로 주의하세요! 자세한 정보와 원본 연구는 여기에서 확인하세요. 설치 Python 3.6 이상 에서만 작동합니다! OS에 impacket이 이미 설치된 경우 예: Kali, 먼저 기존 설치를 모두 제거하세요. 이후에도 import 오류가 발생하면...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...