CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...

SharpSCCM

Tool Overview SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager a.k.a. ConfigMgr, formerly SCCM for lateral movement and credential gathering without requiring access to the SCCM administration console GUI. SharpSCCM was initially created to execu...

RemoteMonologue

RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...

NTLM Coercion Multi-Method

Attempts multiple NTLM coercion primitives against a Windows target: PetitPotam EfsRpcOpenFileRaw and DFSCoerce NetrDfsRemoveStdRoot. Use with SMB or HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """Multi-method NTLM coercion PetitPotam + DFSCoerce.""" from kittysploit import fr...

DFSCoerce NTLM Coercion

Coerces a Windows target to authenticate to an attacker listener via NetrDfsRemoveStdRoot over the netdfs named pipe DFSCoerce. Use with SMB/HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """DFSCoerce NTLM coercion via NetrDfsRemoveStdRoot MS-DFSNM.""" from kittysploit import fro...

PT-2026-99114

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Subpath symlinking on Windows nodes allows for NTLM coercion. NTLM coercion is a technique used to force a remote system to authenticate against a malicious...

Subpath symlinking on Windows nodes permits NTLM coercion

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium 5.8 An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does...

PoC-CVE-2025-24071

❀ coerce-library CVE-2025-24071 — coerción NTLM mediante .library-ms método SMB / TAR ❀ Qué hace Solicita tu IP de ataque y un nombre de archivo , escribe un .library-ms apuntando a \\share, y lo empaqueta en exploit.tar. Cuando el Explorador examina la carpeta donde acaba el .library-ms suelto,...

CVE-2026-26221 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service Hyland.Core.Workflow.NTService.exe. An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 e.g., TimerServiceAPI.rem and...