zerologon

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

CVE-2019-9053-Exploit-Python-3

CVE-2019-9053 Exploit Python 3 Dieses Repository enthält einen Exploit für die Schwachstelle CVE-2019-9053, die in der CMS Made Simple CMSMS-Software gefunden wurde. Der Exploit wurde modifiziert, um mit Python 3 zu funktionieren und ist mit CMSMS Version 2.2.9 und darunter kompatibel. Beschreibu...

woo

Woocommerce 3.3 bis 5.5 - Nicht authentifizierte SQL-Injection https://wpscan.com/vulnerability/1212fec8-1fde-41e5-af70-abdd7ffe5379 WooCommerce-SQLI ausnutzen und Benutzer- und Passwort-Hash abgreifen Befehle root@kitploit: usage: woo.py -h -u URL -f FILE -p PROXY -i WID optional arguments: -h,...

CVE-2005-2428-IBM-Lotus-Domino-R8-Password-Hash-Extraction-Exploit

Questo repository non contiene un README...

NTLMRawUnHide

NTLMRawUnhide.py Autore : Mike Gualtieri Blog : https://www.mike-gualtieri.com Twitter : https://twitter.com/mlgualtieri GitHub : https://github.com/mlgualtieri/NTLMRawUnhide Articolo: https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol Introduzione...

CVE-2019-14314

CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 प्रमाणित SQL इंजेक्शन उपयोग root@kitploit: usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to login with...

PCredz

PCredz 2.1.0 PCredz नेटवर्क ट्रैफ़िक PCAP फ़ाइलें या लाइव कैप्चर से क्रेडेंशियल और प्रमाणीकरण टोकन निकालता है। विशेषताएँ समर्थित प्रोटोकॉल IPv4 और IPv6 दोनों ट्रैफ़िक से क्रेडेंशियल निकालें: NTLM : HTTP, SMB, LDAP, MSSQL, DCE-RPC और अन्य से NTLMv1/v2 हैश Kerberos : AS-REQ Pre-Auth etype 23 हैश HT...

DragonCastle

DragonCastle Una PoC che combina la tecnica di movimento laterale AutodialDLL e SSP per estrarre hash NTLM dal processo LSASS. Descrizione Carica una DLL sulla macchina target. Quindi abilita il registro remoto per modificare la voce AutodialDLL e avvia/riavvia il servizio BITS. Svchosts caricher...

BRC4-BOF-Artillery

Generic Questo repository include una raccolta di BOF generici che ho scritto nel corso del tempo. Questo repository si concentra esclusivamente sul porting e sull'esecuzione, senza modificare il codice sorgente originale per la stabilità. Sebbene in futuro possa condurre ulteriori test, non è...

misp-extractor

مستخرج MISP يتصل هذا الكود بخادم MISP منصة مشاركة معلومات البرامج الضارة معين ويقوم بتحليل عدد محدد من الأحداث، وكتابة عناوين IP وروابط URL وتجمّعات MD5 الموجودة في الأحداث إلى ثلاثة ملفات منفصلة. الاستخدام لاستخدام هذا السكربت، ستحتاج إلى تقديم عنوان URL لمثيل MISP الخاص بك ومفتاح API صالح. يمكن...

CVE-2019-9053-exploit

CVE-2019-9053 — SQL Injection non autenticata in CMS Made Simple Descrizione CVE-2019-9053 è una vulnerabilità di iniezione SQL time-based blind che colpisce CMS Made Simple nelle versioni ≤ 2.2.9. Non richiede autenticazione. Il parametro vulnerabile è m1idlist nel modulo News moduleinterface.ph...

ShadowSpray

ShadowSpray Uno strumento per spruzzare Shadow Credentials su un intero dominio nella speranza di abusare di DACL GenericWrite/GenericAll dimenticate da tempo su altri oggetti nel dominio. Perché questo strumento In molti impegni vedo in BloodHound che il gruppo "Everyone" / "Authenticated Users"...

dumpguard_bof

DumpGuard BOF Porting Beacon Object File BOF di DumpGuard per l'estrazione di hash NTLMv1 dalle sessioni su sistemi Windows moderni. Informazioni su questo progetto Questo repository contiene un'implementazione Beacon Object File BOF di DumpGuard, trasferita dall'implementazione originale C/.NET ...

Domain-Controller-DC-Exploitation-with-Metasploit-Impacket

Domain-Controller-DC-Ausnutzung-mit-Metasploit-Impacket End-to-End-Domain-Controller-Ausnutzung mit Metasploit und Impacket: DC10 entdeckt, Zerologon CVE-2020-1472 ausgenutzt, NTLM-Hashes extrahiert, SYSTEM-Shell erlangt und eine Meterpreter-Sitzung eingerichtet. Zusammenfassung Diese Übung...

CVE-2026-53525

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

EUVD-2026-64186

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

CVE-2026-15162

The CVE-2026-15162 entry concerns the Object Sync for Salesforce WordPress plugin, where an unauthenticated SQL injection is possible via the wordpress_object_type parameter in the /wp-json/object-sync-for-salesforce/push/ REST route. The can_process() check only validates the HTTP method, not ca...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

Exploit for CVE-2025-4396

CVE-2025-4396 - WordPress Relevanssi Time-Based Blind SQL Inje...

CVE-2025-10285 Simplcity Device Manager exposes NTLMv2 hash

The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password...