CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...

CVE-2024-37393

SecurEnvoy MFA has multiple LDAP injection vulnerabilities in versions before 9.4.514. The DESKTOP service at the /secserver HTTP endpoint validates input improperly, enabling unauthenticated remote attackers to exfiltrate Active Directory data (potentially including the cleartext ms-Mcs-AdmPwd u...

November 14, 2023—KB5032196 (OS Build 17763.5122) - EXPIRED

None None...

November 14, 2023—KB5032198 (OS Build 20348.2113)

None None...

November 14, 2023—KB5032202 (OS Build 25398.531)

None None...

May 9, 2023—KB5026362 (OS Build 17763.4377) - EXPIRED

None None...

May 9, 2023—KB5026368 (OS Build 22000.1936)

None None...

April 11, 2023—KB5025230 (OS Build 20348.1668)

None None...

April 11, 2023—KB5025229 (OS Build 17763.4252) - EXPIRED

None None...

April 11, 2023—KB5025224 (OS Build 22000.1817)

None None...

LAPS : Randomizing Local Admin Passwords in Non-persistent Environments

Use LAPS inLocal Admin Passwords for Non-persistent Environments...

ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go

ADReaper is a tool written in Golang which enumerate a Active Directory environment with LDAP queries within few seconds. Installation You can download precompiled executable binaries for Windows/Linux from latest releases Install from source To build from source, clone the repo and build it with...

DonPAPI - Dumping DPAPI Credz Remotely

Dumping revelant information on compromised targets without AV detection DPAPI dumping Lots of credentials are protected by DPAPI. We aim at locating those "secured" credentials, and retreive them using : User password Domaine DPAPI BackupKey Local machine DPAPI Key protecting TaskScheduled blob...

Admin password re-use. Don’t do it

As a pentester, one of the most disappointing sights is see on a test is extensive local admin password reuse. I know others get excited as it means easy pwnage of the network, but for me, it makes my job too straightforward. I want more of a challenge, particularly as resolving the local admin...

SharpLAPS - Retrieve LAPS Password From LDAP

The attribute ms-mcs-AdmPwd stores the clear-text LAPS password. This executable is made to be executed within Cobalt Strike session using execute-assembly. It will retrieve the LAPS password from the Active Directory. Require either: Account with ExtendedRight or Generic All Rights Domain Admin...

Local Administrator Password Solution (LAPS) 導入ガイド (日本語版)

Active Directory 管理者のみなさん、Local Administrator Password Solution LAPS ツールはご存じですか? LAPS ツールは、Active Directory AD に参加して...

LDAP Password Disclosure

This module will gather passwords and password hashes from a target LDAP server via multiple techniques including Windows LAPS. For best results, run with SSL because some attributes are only readable over encrypted connections. Module Options msf use auxiliary/gather/ldap/passwords msf...

LAPSToolkit - Tool To Audit And Attack LAPS Environments

Functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution LAPS. It includes finding groups specifically delegated by sysadmins, finding users with "All Extended Rights" that can vi...

Active Directory Reconnaissance: ADRecon

ADRecon is a tool which extracts various artifacts as highlighted below out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis. The report can provide a holistic picture of the current state of the target AD...

Microsoft Windows: LAPS: Enable local admin password management

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winlapspasswdmanagement.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Enable local admin password management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...