assless-chaps

assless-chaps 使用NT哈希数据库快速破解MSCHAPv2/NTLMv1挑战/响应 简介 Assless CHAPs 是一种高效恢复 MSCHAPv2/NTLMv1 交换中使用的 NT 哈希的方法，前提是你拥有挑战和响应（例如，来自 WiFi EAP WPE 攻击）。 它需要一个 NT 哈希数据库。下面提供了如何从现有列表或使用 hashcat 搭配字典和规则生成这些数据库的说明。我包含了来自 SecLists 的示例数据库。你需要对其进行 bunzip2 解压。 技术原理 MSCHAPv2 交换不需要破解明文密码，我们只需要使用的 NThash。 MSCHAPv2 将...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - fork corregido Un fork funcional de la herramienta de prueba de concepto para CVE-2026-54121, también conocida como Certighost. Investigación original y PoC por @H0j3n y @aniqfakhrul , con análisis detallado en:...

ShadowSpray

ShadowSpray 一款在整个域中进行 Shadow Credentials 喷洒攻击的工具，旨在利用域中其他对象上早已被遗忘的 GenericWrite/GenericAll DACL。 为什么需要这个工具 在很多攻防演练中，我观察到（通过 BloodHound）“Everyone”/“Authenticated Users”/“Domain Users”或其他包含域中几乎所有用户的广泛组，拥有对其他域对象的 GenericWrite/GenericAll DACL。 这些权限可以被滥用来在目标对象上添加 Shadow Credentials，并获取其 TGT 和 NT Hash。...

CVE-2026-54121-CertiGhost

CVE-2026-54121-CertiGhost Este POC es el código POC original de https://github.com/aniqfakhrul/CVE-2026-54121/blob/main/certighost.py pero con ligeros cambios para usar un objeto de equipo que ya controlamos en lugar de depender de la creación de un nuevo equipo que generalmente está limitado a...

Exploit for Improper Authorization in Microsoft

certighost-oneclick CVE-2026-54121 Certighost – One-Click...

EUVD-2015-8643

Malware in sbrugna...

Exploit for CVE-2020-1472

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

CVE-1999-0366

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value...

DEBIAN-CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

PT-2017-7475

Name of the Vulnerable Software and Affected Versions GOsa affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via a crafted password, specifically through the generate smb nt hash function in include/functions.inc. Recommendations At the...

Windows Local User Account Hash Carver

This module will change a local user's password directly in the registry. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Local User Account Hash Carver', 'Description...

DPAT - Domain Password Audit Tool for Pentesters

This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as oclHashcat.pot generated from the oclHashcat tool during password cracking. The report is an HTML report with clickable links. You can run the...

OS X Gather Mac OS X Password Hash Collector

This module dumps SHA-1, LM, NT, and SHA-512 Hashes on OSX. Supports versions 10.3 to 10.14. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'OS X Gather Mac OS X Passwo...

3proxy user account locking

It's possible to lock user's account if user's password is stored as NT-hash via HTTP proxy. Service restart or configuration reload is required to restore account in working state. In addition, Basic authentication is offered as first authentication protocol, it can lead to shoosing weak clearte...

CVE-1999-0366

CVE-1999-0366 concerns Windows NT 4.0 SP4. Affected component: network shares authentication; root cause: null NT hash value enables access with a blank password. Impact stated as PARTIAL confidentiality, integrity, and availability. Exploitation details are not provided in the connected document...

CVE-1999-0366: Improper Authentication

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value...