Zero-day-scanning

zeroscan Zeroscan is a Domain Controller vulnerability scanner, that currently includes checks for Zerologon CVE-2020-1472, MS-PAR/MS-RPRN and SMBv2 Signing. CVE-2020-1472: Uses a built-in script to check for Zerologon CVE-2020-1472, but does NOT attempt to exploit the target, it is simply a...

PrintNightmare

PrintNightmare Python implementation for PrintNightmare CVE-2021-1675 / CVE-2021-34527 using standard Impacket. Installtion $ pip3 install impacket Usage Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: printnightmare.py -h -debug -port destination port -target-ip ip address -hashe...

CoercedPotatoRDLL

Coerced Potato Reflective DLL Privilege escalation from NT Service to SYSTEM using SeImpersonateToken privilege and MS-RPRN functions. Heavily based on https://github.com/Prepouce/CoercedPotato Reflective Loader from https://github.com/stephenfewer/ReflectiveDLLInjection. Install Clone this repo...

ItWasAllADream

It Was All A Dream A CVE-2021-34527 a.k.a PrintNightmare Python Scanner. Allows you to scan entire subnets for the PrintNightmare RCE not the LPE and generates a CSV report with the results. Tests exploitability over MS-PAR and MS-RPRN. This tool has "de-fanged" versions of the Python exploits, i...

CVE-2021-34527

PrintNightmare CVE-2021-34527 This version of the PrintNightmare exploit is based on the code created by Cube0x0, with the following features: Ability to target multiple hosts. Built-in SMB server for payload delivery, removing the need for open file shares. Exploit includes both MS-RPRN & MS-PAR...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

zeroscan

zeroscan Zeroscanは、ドメインコントローラの脆弱性スキャナで、現在Zerologon CVE-2020-1472、MS-PAR/MS-RPRN、SMBv2署名のチェックを含んでいます。 CVE-2020-1472: 組み込みスクリプトを使用してZerologon CVE-2020-1472をチェックしますが、ターゲットの悪用は試みず、単なる脆弱性スキャナです。 コードベースの借用元: https://github.com/SecuraBV/CVE-2020-1472 MS-PAR / MS-RPRN:...

Exploit for CVE-2021-34527

PrintNightmare CVE-2021-34527 This version of the PrintNigh...

MultiPotato - Another Potato to get SYSTEM via SeImpersonate privileges

First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the code can be...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...