Post Windows Gather NTDS.DIT Location

This module will find the location of the NTDS.DIT file from the Registry, check that it exists, and display its location on the screen, which is useful if you wish to manually acquire the file using ntdsutil or vss. This module requires Metasploit: https://metasploit.com/download Current source:...

samba: DoS to AD-DC due to insufficient checking of asn1 memory allocation

A denial of service flaw was found in the LDAP server provided by the AD DC in the Samba process daemon. A remote attacker could exploit this flaw by sending a specially crafted packet, which could cause the server to consume an excessive amount of memory and crash...

Fedora 23 : rolekit-0.4.0-4.rc1.fc23 (2015-14897)

rolekit-0.4.0-3.rc1.fc23 - Added support for installing roles through kickstart - Added support for providing setting values through stdin - Enabled deploying Domain Controller and Database Server with no mandatory options - New API feature: sanitize which will remove sensitive information from t...

SMB Group Policy Preference Saved Passwords Enumeration

This module enumerates files from target domain controllers and connects to them via SMB. It then looks for Group Policy Preference XML files containing local/domain user accounts and passwords and decrypts them using Microsoft's public AES key. This module has been tested successfully on a Win2k...

Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2015-04667)

Microsoft Windows Server is a series of servers based on the windows operating system launched by the U.S. Microsoft Microsoft. A security vulnerability exists in the Netlogon service for Microsoft Windows due to the program failing to properly implement domain-controller communication. A remote...

MS15-071: Vulnerability in NETLOGON Could Allow Elevation of Privilege (3068457)

The remote Windows host is affected by a privilege escalation vulnerability due to the Netlogon service improperly establishing a communications channel to a primary domain controller PDC. An attacker, with access to the PDC, can exploit this by using a crafted application to create a secure...

Windows Domain Controller Hashdump

This module attempts to copy the NTDS.dit database from a live Domain Controller and then parse out all of the User Accounts. It saves all of the captured password hashes, including historical ones. This module requires Metasploit: https://metasploit.com/download Current source:...

The vulnerability of the CentOS operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the samba-dc-libs-4.1.1 package for the CentOS operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited...

The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the samba-dc-libs-4.1.1 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited...

MS15-027: Vulnerability in NETLOGON Could Allow Spoofing (3002657)

The remote Windows host is affected by a spoofing vulnerability due to the Netlogon service improperly establishing a secure communications channel to a different machine with a spoofed computer name. A remote attacker, on a domain-joined system with the ability to observe network traffic, can...

Security update for samba (important)

samba was updated to fix two security issues. These security issues were fixed: - CVE-2015-0240: Ensure we don't call tallocfree on an uninitialized pointer bnc917376. - CVE-2014-8143: Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain...

Surebackup with the Domain Controller role enabled causes Windows crash (the “blue screen” error) on the Veeam Backup server.

Challenge During a SureBackup or SureReplica job that processes a VM that has been configured to use the Domain Controller role, a Windows "blue screen" error occurs on the Veeam Backup Server. Cause Veeam Backup & Replication software mounts the VM's VMDK using VDK which can cause some anti-viru...

Microsoft Windows Group Policy Remote Code Execution (MS15-011; CVE-2015-0008)

A remote code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. An attacker can exploit this vulnerability by convincing a victim with a...

Debian Security Advisory DSA 3171-1 (samba - security update)

Richard van Eeden of Microsoft Vulnerability Research discovered that Samba, a SMB/CIFS file, print, and login server for Unix, contains a flaw in the netlogon server code which allows remote code execution with root privileges from an unauthenticated connection. OpenVAS Vulnerability Test $Id:...

Microsoft Windows domain-configured client Group Policy fails to authenticate servers

Overview Microsoft Windows domain-configured client Group Policy fails to authenticate servers over Universal Naming Convention UNC paths. Description Microsoft has released MS15-011, detailing a critical flaw in which Windows domain-configured client Group Policy fails to authenticate servers ov...

CVE-2015-0008

The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remot...

Security feature bypass

The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to...

Remote code execution

The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remot...

Microsoft Windows SMB Security Feature Bypass (MS15-014; CVE-2015-0009)

A security feature bypass vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy settings are applied when SMB signing failures occur. An attacker can exploit this vulnerability by a man-in-the-middle attack that modifies domain controller responses to client...

Samba Elevation of Privilege Vulnerability

Samba is a set of programs that implement the SMB Server Messages Block protocol, cross-platform file sharing and print sharing services. The Samba AD DC allows administrators to assign user and computer account creation to certain users or groups, but fails to check the UFSERVERTRUSTACCOUNT bit...