impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

MSSqlPwner

MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM Hashes, and kerberos tickets. With MSSqlPwner, users can...

enumdb

enumdb Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search fo...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

jok3r

.. raw:: html Jok3r v3 beta...

mssqlproxy

mssqlproxy mssqlproxy 是一个工具包，旨在通过受损的 Microsoft SQL Server 利用套接字重用（socket reuse）在受限环境中执行横向移动。客户端需要 impacket 和 SQL 服务器上的 sysadmin 权限。 在继续之前，请仔细阅读这篇文章。 它由三部分组成： CLR 程序集 ：编译 assembly.cs 核心 DLL ：编译 reciclador.sln 客户端 ：mssqlclient.py（基于 Impacket 示例） 你可以自行编译库文件，或从发布页面（x64）下载。 编译 要生成核心 DLL，只需将项目导入 Visual...

MSSQL-Pentest-Cheatsheet

🗄️ Chuleta de pentest MSSQL Una hoja de referencia práctica de pruebas de penetración de Microsoft SQL Server diseñada para pentesters, red teamers y estudiantes de ciberseguridad para comprender cómo enumerar, explotar y abusar de bases de datos MSSQL mal configuradas durante evaluaciones de...

mssqlbof

mssqlbof Un conjunto de Beacon Object Files para Microsoft SQL Server que habla directamente TDS 7.4 en el cable, en C. Sin msodbcsql.dll, sin sqloledb.dll, sin .NET CLR, sin PowerShell. Un COFF por arquitectura, se carga en cada beacon que respeta la API Beacon canónica. Por qué SQL Server apare...

sccmsqlclient

sccmsqlclient Un cliente MSSQL dedicado para la exploración y explotación de bases de datos SCCM. Consultas de reconocimiento Ejecutar scripts de PowerShell en clientes administrados Extraer secretos Instalación PIPX root@kitploit: $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PI...

ntlm_relay_gat

NTLM Relay Gat Description NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines the process of exploiting NTLM relay vulnerabilities,...

ntlm_relay_gat

NTLM Relay Gat 描述 NTLM Relay Gat 是一款强大的工具，旨在利用 Impacket 工具套件中的 ntlmrelayx.py 来自动化执行 NTLM 中继攻击。通过利用 ntlmrelayx.py 的功能，NTLM Relay Gat 简化了利用 NTLM 中继漏洞的过程，提供了从列出 SMB 共享到在 MSSQL 数据库上执行命令等一系列功能。 特性 多线程支持 ：使用多个线程并发执行操作。 SMB 共享枚举 ：列出可用的 SMB 共享。 SMB Shell 执行 ：通过 SMB 执行 shell。 秘密转储 ：从目标转储秘密信息。 MSSQL 数据库枚举...

MSSQL-Analysis-Coerce

MSSQL Analysis Services - Coerced Authentication A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine. This proof of concept is co-authored by : Podalirius: Worty: Proof of concept In order to trigger the authentification as the local machine account, we need to...

LabS4U2Self

Laboratorio de abuso S4U2Self Este laboratorio tiene como objetivo proporcionar un entorno seguro para probar el exploit S4U2Self abuse Despliegue El proyecto desplegará: 1 DC con un único domain admin hpotter 1 MSSQL con una contraseña débil para sa El despliegue se realiza mediante terraform y...

CVE-2020-15394-PoC

CVE-2020-15394 DBMS: MSSQL SQL查询中的TRUE条件 root@kitploit: POST /AppManager/json/ApmAdminServices/checkResourceID HTTP/1.1 Host: redacted.com Content-Type: application/x-www-form-urlencoded Content-Length: 67 resourceIds=1+AND+SELECT+CASE+WHEN+1=1+THEN+1+ELSE+1/0+END=1-- root@kitploit: HTTP/1.1 200...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

Exploit-CVE-2026-56705

CVE-2026-56705 – Explotador Masivo de Inyección DSN en MSSQL de Adminer 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs 📌 Descripción Esta herramienta explota CVE-2026-56705 , una vulnerabilidad de Ejecución Remota de Código RCE no...

CVE-2026-56705

CVE-2026-56705: Adminer 5.4.3 — Unauthenticated RCE via MSSQL PDO DSN Injection...

mssql-command-tool

mssql 终端连接工具|命令执行 Example root@kitploit: ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "whoami" nt service\mssqlserver ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "net user" \ 的用户帐户...

CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...