whiskeysamlandfriends

WhiskeySAML 及其相关工具 TicketsPlease TicketsPlease: Python 库，用于协助生成 Kerberos 票据、远程获取 ADFS 配置设置、生成 Golden SAML 令牌以及获取 Azure 访问令牌。 WhiskeySAML WhiskeySAML: 用于远程 ADFS 配置提取的 Golden SAML 攻击概念验证工具。该工具利用了 TicketsPlease 库。 ShockNAwe ShockNAwe: 概念验证工具，用于生成 Golden SAML 令牌，该令牌将用于向 Azure 核心管理请求访问令牌，随后用于枚举和攻击 Azu...

shimit

shimit shimit 是一个实现 Golden SAML 攻击的 Python 工具。更多信息可在我们博客中的以下文章中找到。 python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity SAMLVALIDITY -n SESSIONNAME -r ROLES -id ARN -o OUTFILE -l LOADFILE -t TIME ██╗...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

mimikatz

mimikatz mimikatz 是我为了学习 C 语言并对 Windows 安全进行一些实验而制作的一款工具。 如今它以从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据而闻名。mimikatz 还可以执行哈希传递（pass-the-hash）、票据传递（pass-the-ticket）或构建黄金票据（Golden tickets）。 .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin DELPY gentilkiwi...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory 漏洞利用速查表 此速查表包含 Windows Active Directory 的常见枚举和攻击方法。 ℹ️ 此仓库由 Nikos Katsiopis 和 Nikos Vourdas 创建。 此速查表灵感来源于 PayloadAllTheThings 仓库。 摘要 Active Directory 漏洞利用速查表 摘要 工具 域枚举 使用 PowerView 使用 AD Module 使用 BloodHound 远程 BloodHound 现场 BloodHound 使用 Adalanche 远程 Adalanche 导出枚举对象 有用的枚举工具...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

certsync

certsync certsync 是一种用于远程导出 NTDS 的新技术，但这次不使用 DRSUAPI ：它利用黄金证书和UnPAC the hash。 其工作分为以下几个步骤： 1. 从 LDAP 导出用户列表、CA 信息和 CRL 2. 导出 CA 证书和私钥 3. 为每个用户离线伪造证书 4. 对每个用户执行 UnPAC the hash，以获取 nt 和 lm 哈希 $ certsync -u khal.drogo -p 'horse' -d essos.local -dc-ip 192.168.56.12 -ns 192.168.56.12 Collecting...

vulnerable-AD

Vulnerable-AD 创建一个易受攻击的活动目录，让您可以在本地实验室中测试大多数活动目录攻击。 主要功能 随机化攻击 全面覆盖上述攻击 您需要在已安装活动目录的域控制器上运行脚本 部分攻击需要客户端工作站 支持的攻击 滥用ACL/ACE Kerberoasting AS-REP Roasting 滥用DnsAdmins 对象描述中的密码 使用默认密码的用户对象 Changeme123! 密码喷洒 DCSync 白银票据 黄金票据 传递哈希 传递票据 SMB签名已禁用 示例 if you didn't install Active Directory yet , you can t...

MakeMeEnterpriseAdmin

Ejemplo de ejecución exitosa: ====================================================================== /\ Elevated domain admins to Enterprise admins - version 1.0 || /||\ Require: domain admin right |:||:| or more specifically DS-Replication-Get-Changes-All |/||| Vincent LE TOUX...

mimikatz

mimikatz mimikatz es una herramienta que he creado para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocido por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

Invoke-sAMSpoofing

Invoke-sAMSpoofing Explotaciones CVE-2021-42287/CVE-2021-42278 en powershell Tabla de contenido Resumen Menú Capturas de pantalla Referencias Resumen Un script sencillo para atacar AD con las explotaciones CVE-2021-42287/CVE-2021-42278 automáticamente. Menú Invoke-sAMSpooofing Invoke-GoldenTicket...

SUSE CVE-2026-64753

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2026-86902

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

CVE-2026-86909

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks...

CVE-2026-86911

This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts...

CVE-2026-86901

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure...

CVE-2026-86894

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox...

CVE-2026-86900

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure...

DEBIAN-CVE-2026-84635

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination...