707 matches found
latma
Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...
NTLMRecon
Overview NTLMRecon is a Golang version of the original NTLMRecon utility written by Sachin Kamath AKA pwnfoo. NTLMRecon can be leveraged to perform brute forcing against a targeted webserver to identify common application endpoints supporting NTLM authentication. This includes endpoints such as t...
Sharp-SMBExec
Sharp-SMBExec A native C conversion of Kevin Robertsons Invoke-SMBExec powershell script. https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1 Built for .NET 3.5 Usage Sharp-SMBExec.exe hash:"hash" username:"username" domain:"domain.tld" target:"target.domain.tld"...
LDAPPER
Introduction This tool was written to address a lot of the issues I was experiencing with ldapsearch and AD interaction in general. In particular, this tool addresses the following problems that I've experienced: 1. Inability to return more than a thousand results from AD. This tool supports LDAP...
nimrm
nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT...
imposter
IMPOSTER A pentest tool used to attack windows clients on rogue networks. Current version Features Downgrade LDAP to NTLM authentication Fake initial steps of an domain controller to fool Network Location Awareness Servers DNS, CLDAP, LDAP Setup The current version have been tested on Kali Linux...
SilentHound
SilentHound Quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc. Created by Nick Swink from Layer 8 Security. Installation Using pipenv recommended method root@kitploit: python3 -m pip install --user pipenv git clone...
cve-2019-1040-scanner
CVE-2019-1040 scanner Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target hosts and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx. Note...
OWA-Password-Sprayer
OWA-Password-Sprayer OWA Password Sprayer This Python script facilitates password spraying against Outlook Web Access OWA endpoints. Password spraying is a technique used to test a single password against multiple usernames, aiming to find valid credentials for accessing the OWA. Features: Suppor...
CVE-2024-4573-Mitigation-Script
CVE-2024-4573-Mitigation-Script CVE-2024-43451 是一个存在于允许 NTLM 身份验证的系统中的漏洞。NTLM 是一种旧协议，可能被利用进行凭据中继攻击或暴力破解攻击。当 NTLM 被启用时，该漏洞会使系统容易受到未授权访问的影响，攻击者仅需极少的交互就可能泄露用户的 NTLMv2 哈希值。 此检测脚本的工作原理如下： 注册表路径检查： 从注册表路径 HKLM:\SYSTEM\CurrentControlSet\Control\Lsa 读取 LmCompatibilityLevel 值。 配置评估： 如果 LmCompatibilityLeve...
cve-2023-23397-detection-lab
CVE-2023-23397 Detection & Mitigation Research Lab Overview This project is a defensive cybersecurity research lab focused on the network behavior associated with CVE-2023-23397. The project studies suspicious outbound SMB and NTLM authentication from a Windows endpoint and demonstrates a complet...
RemoteMonologue
RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...
CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...
CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...
Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile
A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...
K000163263: Go vunerability CVE-2026-32952
Security Advisory Description go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version...
TencentOS Server 4: libsoup3 (TSSA-2026:0839)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0839 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
TencentOS Server 4: libsoup (TSSA-2026:0838)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0838 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
