knowsmore

Knows More KnowsMore officially supports Python 3.8+. Main features Import NTLM Hashes from .ntds output txt file generated by CrackMapExec or secretsdump.py Import NTLM Hashes from NTDS.dit and SYSTEM Import Cracked NTLM hashes from hashcat output file Import BloodHound ZIP or JSON file BloodHou...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

lil-pwny

Lil Pwny 使用 Python 快速离线审计 Active Directory 密码。 关于 Lil Pwny Lil Pwny 是一个 Python 应用程序，用于对从 Active Directory 恢复的用户密码的 NTLM 哈希进行离线审计，并与 Have I Been Pwned 中已知的被泄露密码进行比对。结果将以 JSON 格式输出，包含用户名、匹配的哈希（可混淆）以及该密码在 HIBP 中被发现的次数。 更多关于 Lil Pwny 的信息，请访问我的博客 功能 自定义密码审计 ：能够提供您自己的自定义密码列表，用于检查 AD...

CLEANSTART-2026-FU14728 SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests

Security vulnerability affects the apache2 package. SSRF in Apache HTTP Server on Windows with modrewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests...

Doozer

Doozer Doozer 是一款可扩展的自动化哈希破解工具，用于自动解析、破解和组织密码哈希。目前，Doozer 支持 nt/lm、ntlmv1 和 ntlmv2 哈希（来自 Responder 或 SAM），但其模块化架构允许轻松插入其他哈希类型。一个基于 Django 的简单 Web 界面使用户能够实时查看破解会话、查看会话结果以及搜索哈希数据库。此外，还暴露了一个简单的 REST API，使脚本能够轻松与数据库交互。 Doozer 具备文件夹监控功能；为提供无缝的哈希破解方法，Doozer 允许您设置一个文件夹，用于监控哈希文件。一旦文件被放入此位置，Doozer...

ranger

ranger 一个支持安全专业人员访问和与远程基于Microsoft Windows系统交互的工具。 这个项目的构思源于这样的想法：我们并没有发明弓箭，只是找到了一种更高效的用法。 Ranger是一个命令行驱动的攻击和渗透测试工具，能够使用实例化的投石车服务器向Windows系统投送能力。只要用户拥有一组凭据或哈希集（NTLM、LM、LM:NTLM），就可以访问信任范围内的系统。...

Corporate_Masks

CorporateMasks Máscaras de Hashcat de 8-14 caracteres basadas en el análisis de 3,2 millones de hashes NTLM crackeados durante pruebas de penetración...

DeadMatter

DeadMatter DeadMatter es una herramienta especializada escrita en C, diseñada para extraer información sensible, como hashes de contraseñas de sesiones de inicio de sesión activas, a partir de volcados de memoria. Emplea técnicas de carving para recuperar credenciales de diversos tipos de archivo...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777946314)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777946314 advisory. - Server-Side Request Forgery SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

EulerOS 2.0 SP13 : git (EulerOS-SA-2026-2288)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git for Windows is the Windows port of Git. Prior to 2.53.02, it is possible to obtain a user's NTLM hash by tricking them into cloning from a...

Exploit for CVE-2026-54424

CVE-2026-54424 Exploiting Parsec for Windows versions 150...

CVE-2026-39906

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling...

CVE-2026-32631

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses a...

CVE-2026-32631 Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses a...

CVE-2026-32631 Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses a...

System-Exploitation-Privilege-Escalation

System Exploitation & Privilege Escalation Lab 📄 Project O...

CVE-2026-26333

Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs including EndeavorServer.rem and RemoteFileReceiver.rem and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An...

CVE-2026-26333

Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs including EndeavorServer.rem and RemoteFileReceiver.rem and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An...