zBang

zBang은 스캔된 네트워크에서 잠재적인 권한 계정 위협을 탐지하는 특수 위험 평가 도구입니다. 조직 및 레드팀은 zBang을 활용하여 잠재적인 공격 벡터를 식별하고 네트워크의 보안 태세를 개선할 수 있습니다. 결과는 그래픽 인터페이스 또는 원시 출력 파일 검토를 통해 분석할 수 있습니다. zBang에 대한 자세한 내용은 @Hechtov의 Big zBang Theory 블로그 게시물에서 확인할 수 있습니다:...

KerberosRun

KerberosRun KerberosRun은 제가 ADCollector와 함께 AD 보안을 연구하기 위해 사용하는 작은 도구입니다. KerberosRun은 Steve Syfuhs가 만든 Kerberos.NET 라이브러리를 사용합니다. 일부 코드는 Harmj0y의 Rubeus 프로젝트에서 가져와 수정되었습니다. dev2null이 이 프로젝트의 주요 작성자입니다. 제 동료 Constantin은 도구 구축을 도와주고 많은 논의를 함께하며 아이디어를 제시한 협력자입니다. Steve에게 훌륭한 라이브러리를 만들어주고 코드 문제를 해결하...

CVE-2019-1040-dcpwn

CVE-2019-1040-dcpwn 훌륭한 글입니다! CVE-2019-1040 악용 - RCE 및 도메인 관리자 권한 획득을 위한 릴레이 취약점 결합 . 그래서 사용하기 쉽게 dcpwn.py를 작성했습니다. 요구 사항 이 도구들은 impacket이 필요합니다. pip로 설치할 수 있습니다. pip install impacket 사용법 usage: dcpwn.py -h -u USERNAME -p PASSWORD --hashes HASHES -d DOMAIN --smb-port destination port --callback-i...

Change-Lockscreen

Change-Lockscreen Change-Lockscreen 是一款通过命令行更改 Windows 锁屏图像，以 SYSTEM 身份触发网络身份验证，从而执行权限提升攻击的工具，例如下面链接文章中所描述的攻击方式： https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation 功能 默认情况下，Windows 10 具有一项名为 Windows Spotligh...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 特権昇格の脆弱性 説明 Modify Computers は、ADManager でコンピュータを管理するための定義済みロールです。テクニシャン ユーザーがコンピュータに対して Modify Computers 権限を持っている場合、そのコンピュータ オブジェクトの userAccountControl 属性と msDS-AllowedToDelegateTo 属性を変更できます。これにより、テクニシャン ユーザーは、委任された組織単位内の任意のコンピュータに対して制約付き Kerberos 委任...

Astra Linux – Vulnerability in Heimdal

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11, and 4.11.x before 4.11.3 have a issue where the S4U MS-SFU Kerberos delegation model includes a feature that allows a subset of clients to be opt-out from constrained delegation in either S4U2Self or regular Kerberos authentication...

Metasploit Wrap-Up 02/06/2026

Google Summer of Code 2026 Our very own Jack Heysel has added some documentation which outlines the Metasploit Framework project ideas for GSoC 2026. For anyone interested in applying please see GSoC-How-To-Apply documentation, or reach out on slack to any of the following GSoC mentors on Slack v...

MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.312.b07-1.el7 (AXSA:2021-2489:11)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2489:11 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

MiracleLinux 8 : java-1.8.0-openjdk-1.8.0.312.b07-1.el8 (AXSA:2021-2491:12)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2491:12 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

MiracleLinux 8 : java-11-openjdk-11.0.13.0.8-1.el8 (AXSA:2021-2492:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2492:13 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

MiracleLinux 7 : java-11-openjdk-11.0.13.0.8-1.el7 (AXSA:2021-2490:12)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2490:12 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

MiracleLinux 8 : idm:DL1 (AXSA:2024-7462:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7462:01 advisory. Kerberos: delegation constrain bypass in S4U2Proxy CVE-2020-17049 ipa: Invalid CSRF protection CVE-2023-5455 Tenable has extracted the preceding...

TencentOS Server 3: curl (TSSA-2023:0172)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0172 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

JLSEC-2025-30 An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which...

An authentication bypass vulnerability exists libcurl 8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPTGSSAPIDELEGATION option. This vulnerability affects...

EUVD-2019-5985

Malware in sbrugna...

Security Bulletin: Security vulnerabilities were discovered in IBM Application Gateway

Summary Security vulnerabilities were addressed in IBM Application Gateway. Vulnerability Details CVEID:CVE-2022-31629 DESCRIPTION: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser...

Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege

Exploit Title: ManageEngine ADManager Plus Build 7210 Elevation of Privilege Vulnerability Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/ad-manager/ Details:...

Astra Linux – Vulnerability in freeipa

A vulnerability was discovered in FreeIPA regarding the initial implementation of MS-SFU by MIT Kerberos. This implementation lacked a condition for granting the “forwardable” flag on S4U2Self tickets. Fixing this issue required adding a special case for the checkallowedtodelegate function: If th...

freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the checkallowedtodelegate function: If the target service...

Kerberos: delegation constrain bypass in S4U2Proxy

It was found that the Kerberos Key Distribution Center KDC delegation feature, Service for User S4U, did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user...