latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

imposter

IMPOSTER Una herramienta de pentest utilizada para atacar clientes Windows en redes maliciosas. Versión actual Características Degradar la autenticación LDAP a NTLM Falsificar los pasos iniciales de un controlador de dominio para engañar a Network Location Awareness Servidores DNS, CLDAP, LDAP...

nimrm

nimrm Cliente de shell WinRM nativo escrito en Nim Versión 1.2.0 · Autor Chokri Hammedi blue0x1 · Licencia MIT Aviso legal nimrm está destinado a la administración legítima, las pruebas de seguridad y la investigación en sistemas que usted posee o para los que tiene permiso explícito de acceso. E...

NTLMRecon

概述 NTLMRecon 是 Sachin Kamath（AKA pwnfoo）所编写原始 NTLMRecon 工具的 Golang 版本。NTLMRecon 可用于对目标 Web 服务器进行暴力破解，以识别常见支持 NTLM 身份验证的应用程序端点。这些端点包括 Exchange Web Services 端点，后者通常可用于绕过多重身份验证。 该工具支持从暴露的 NTLM 身份验证端点收集元数据，包括计算机名、Active Directory 域名以及 Active Directory 林名。这些信息无需事先认证即可获取，只需向服务器发送 NTLM NEGOTIATEMESSAGE...

LDAPPER

Introducción Esta herramienta fue escrita para solucionar muchos de los problemas que experimentaba con ldapsearch y la interacción con AD en general. En particular, esta herramienta aborda los siguientes problemas que he experimentado: 1. Incapacidad de devolver más de mil resultados de AD. Esta...

cve-2023-23397-detection-lab

CVE-2023-23397 Detection & Mitigation Research Lab Overview This project is a defensive cybersecurity research lab focused on the network behavior associated with CVE-2023-23397. The project studies suspicious outbound SMB and NTLM authentication from a Windows endpoint and demonstrates a complet...

Sharp-SMBExec

Sharp-SMBExec Kevin Robertson 的 Invoke-SMBExec PowerShell 脚本的原生 C 转换版本。 https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1 为 .NET 3.5 构建 使用方法 Sharp-SMBExec.exe hash:"哈希值" username:"用户名" domain:"域名.tld" target:"目标域名.tld" command:"命令" 描述 此程序集允许你通过为指定用户提供 NTLM 哈希值，使用 SM...

cve-2019-1040-scanner

Escáner de CVE-2019-1040 Comprueba la vulnerabilidad CVE-2019-1040 sobre SMB. El script establecerá una conexión con el/los hosts objetivo y enviará una autenticación NTLM inválida. Si esta es aceptada, el host es vulnerable a CVE-2019-1040 y puedes ejecutar el ataque MIC Remove con ntlmrelayx. T...

SilentHound

SilentHound Enumera silenciosamente un dominio de Active Directory mediante el análisis LDAP de usuarios, administradores, grupos, etc. Creado por Nick Swink de Layer 8 Security. Instalación Usando pipenv método recomendado python3 -m pip install --user pipenv git clone...

RemoteMonologue

RemoteMonologue RemoteMonologue es una técnica de recolección de credenciales de Windows que permite comprometer usuarios de forma remota aprovechando la clave RunAs del usuario interactivo y forzando autenticaciones NTLM mediante DCOM. Lea RemoteMonologue: Weaponizing DCOM for NTLM Authenticatio...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_2182)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262182 advisory. libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-0719 libsoup: Stack-Based...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2026_2216)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262216 advisory. libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-0719 libsoup: Stack-Based Buffe...

Rocky Linux 8 [CIQ] Security Update: spice-client-win-x64 / spice-client-win-x86 Multiple Vulnerabilities (crlsa-2026_2214)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262214 advisory. libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-0719 libsoup: Stack-Based Buffe...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1779117827)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1779117827 advisory. - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbinddpamauthcrap.c. When performing NTLM...

OWA-Password-Sprayer

OWA-Password-Sprayer Sprayer de contraseñas OWA Este script de Python facilita el rociado de contraseñas password spraying contra endpoints de Outlook Web Access OWA. El rociado de contraseñas es una técnica utilizada para probar una única contraseña contra múltiples usuarios, con el objetivo de...

FreeBSD : Fetchmail -- NTLM potential remote code execution (15e880b4-b9ed-11f1-b17e-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 15e880b4-b9ed-11f1-b17e-3c7c3fba4204 advisory. Fetchmail reports: CVE-2026-94184: Fetchmail's NTLM authentication client can in some cases be...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 es una vulnerabilidad en sistemas que permiten la autenticación NTLM, un protocolo heredado que puede ser explotado para ataques de reenvío de credenciales o ataques de fuerza bruta. Esta vulnerabilidad surge cuando NTLM está habilitado, dejando a lo...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

CVE-2026-94184 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...