EUVD-2026-91333

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

powerview.py

Installation | Basic Usage | Obfuscation | Modules | Logging | User Defined Rules | MCP | Plugins | Acknowledgements Overview PowerView.py is an alternative for the awesome original PowerView.ps1 script. Most of the modules used in PowerView are available here some of the flags are changed . Main...

LDAPMon

LDAPMon LDAPMon 是 Microsoft-Windows-LDAP-Client ETW 提供程序的一个 POC 遥测收集器。启动后，日志将存储在事件查看器中。该 POC 附带一个 Sentinel 解析器，因此如果您想在 SIEM 中收集这些数据，可以这样做。最好在 Sysmon 旁边运行。 安装 以管理员身份打开 cmd 或 PowerShell 提示符。 运行 LDAPMon.exe。 不要关闭 LDAPMon 窗口。 如果一切成功，您将看到以下内容： .\LDAPMonitor.exe Uninstalling Manifest.... Manifest...

Cable

Cable Cable 是一款后渗透工具，用于对 Active Directory 环境进行侦察和以自由访问控制列表（DACL）为重点的利用。此工具主要是为了在 Active Directory 环境中学习更多关于 .NET 攻击性开发的知识而创建，同时希望扩展我目前关于以 Active Directory 为重点的攻击性安全的知识与理解。 用法 |\ |\ |\ |\ \ |\ \ \ \ |\ \ |\ \ \ |\ /\ \ \ \ \ /| \ \ \ \ \ \ \ \ \ \ \ \ |/ \ \ \ \ \ \ \ \ |\ \ \ \ \ |\ \ ...

goddi

アーカイブノート このプロジェクトは現在積極的にはメンテナンスされていません。 goddi - Go によるドメイン情報ダンプ 以下の方々の作業に基づいています: Scott Sutherland @nullbind、Antti Rantasaari、Eric Gruber @egru、Will Schroeder @harmj0y、およびPowerViewの作者の方々。 インストール...

CVE-2026-21011-Log4j-style-JNDI-Injection-in-Custom-Logger-Simulated-

CVE-2026-21011 – 自定义日志记录器中的 Log4j 式 JNDI 注入（模拟） 程序代码（用 Python 模拟 Java 的示例） log4jsim.py - Custom logger that evaluates $... patterns import subprocess, re def logmessage: Vulnerable: looks up JNDI-like syntax and executes pattern = r'$\jndi:.+?' for match in re.finditerpattern, message: lookup =...

homelab-CVE-2021-44228

Homelab: Log4Shell CVE-2021-44228 in Apache Solr Docker による管理環境で、Apache Solr における Log4Shell 脆弱性の再現と学習を行います。 環境 ターゲット solr-lab: Apache Solr v8.11.0 vulhub/solr:8.11.0 で、脆弱性のある Log4j バージョンが実行されています。 攻撃者 kali-lab: nmap、curl、netcat がプリインストールされた基本的な Kali Linux コンテナ。 ラボの起動方法 1. コンテナの起動...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

LDAP-Monitoring-Watchdog

LDAP Watchdog 概述 LDAP Watchdog 是一款实时监控 LDAP 目录中记录变更的工具。它提供了一种跟踪和可视化用户及组条目修改、添加和删除的机制，使用户能够将预期变更与实际变更关联起来，并识别潜在的安全事件。该工具专为 OpenLDAP 和 Linux 设计，但也可能适用于其他 LDAP 实现。它使用 Python 编写，仅需 ldap3 库。 本软件由 Joshua Rogers 编写。 如果您对以下任意一点感兴趣，那么 LDAP Watchdog 非常适合您： 通过 Slack Webhook 集成，按需了解 LDAP 目录中的动态。 查看 LDAP...

EUVD-2026-91139

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

EUVD-2026-91076

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

DEBIAN-CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

TPASLog4ShellPoC

TPAS Log4Shell PoC このリポジトリは、Log4Shell脆弱性（CVE-2021-44228）の概念実証（PoC）を含んでいます。これは、FCUPの情報セキュリティ修士課程におけるカリキュラム科目TPASの課題の一部として開発されました。 特徴： React SPAフロントエンド：ダミーJSON API https://dummyjson.com/docs/products を介して提供される、商品の閲覧や説明、価格、評価などの基本詳細を表示するような基本的な機能を備えた汎用eコマースウェブサイトをシミュレートします。 脆弱なバージョンのLog4j...

LOG4J-CVE-2021-44228

LOG4J-CVE-2021-44228 Log4Shell — CVE-2021-44228としても知られる — は、Apache FoundationのLog4jを使用するシステムにおいてリモートコード実行を可能にする深刻な脆弱性です。Log4jは、商用・オープンソースのソフトウェア製品やユーティリティで広く利用されているオープンソースのJavaライブラリです。 POC分析 脆弱なサーバーはポート8080で動作しています そして、ldapサーバーは2つのポート（http 8888 と ldap 1389）で動作しています エクスプロイトコマンド curl 172.17.0.2:808...

Linux Distros Unpatched Vulnerability : CVE-2026-86344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage ...

Linux Distros Unpatched Vulnerability : CVE-2026-86345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an...

RabbitMQ 3.13.x < 3.13.18 / 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is 3.13.x prior to 3.13.18, or 4.0.x prior to 4.0.23, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities: - The JWKS key fetching mechanism in uaajwt.erl does not...

UBUNTU-CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...