CVE-2023-23397

Un PoC simple en PowerShell para CVE-2023-23397 CVE-2023-23397 es una vulnerabilidad en MS Outlook que permite a un atacante potencialmente exfiltrar detalles de autenticación del usuario. La vulnerabilidad se relaciona con la capacidad de un atacante de especificar una ruta UNC en la propiedad...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

CVE-2020-15931

CVE-2020-15931 Netwrix Account Lockout Examiner 4.1 Domain Admin Account Credential Disclosure Vulnerability Vulnerbility Overview Netwrix Account Lockout Examiner ALE before 5.1 allows an unauthenticated, remote adversary to trigger a connection to an attacker-controlled system and capture the...

CVE-2018-16890

CVE-2018-16890 An out-of-bounds read flaw was found in the way curl handled NTLMv2 type-2 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash. A simple script to check your curl...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

SMBetray

SMBetray Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to intercept and modify insecure SMB connections, as well as compromise some secured SMB connections if credentials are known. Background Released at Defcon26 at "SMBetray - Backdooring and Breaking Signatures" I...

NTLMRawUnHide

NTLMRawUnhide.py Author : Mike Gualtieri Blog : https://www.mike-gualtieri.com Twitter : https://twitter.com/mlgualtieri GitHub : https://github.com/mlgualtieri/NTLMRawUnhide Write up: https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol Intro NTLMRawUnhide.py is ...

CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Estudio de caso de vulnerabilidad: CVE-2026-33829 Coerción NTLM en la Herramienta Recortes de Windows Resumen ejecutivo Este informe detalla la reproducción técnica de CVE-2026-33829 , una vulnerabilidad de divulgación de información en el marco de la moderna aplicación...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

CVE-2025-24054-PoC

CVE-2025-24054 PoC A simple Proof of Concept for CVE-2025-24054 – Windows Library .library-ms NTLM Hash Disclosure Vulnerability. ⚠️ For Educational and Authorized Lab Use Only Description CVE-2025-24054 allows an attacker to force a Windows system to leak the victim's Net-NTLMv2 hash by using a...

CVE-2023-35636

CVE-2023-35636 Microsoft Outlook Information Disclosure Vulnerability leak password hash - Expect Script POC CVE-2023-35636 an exploit of the calendar sharing function in Microsoft Outlook, whereby adding two headers to an email directs Outlook to share content and contact a designated machine...

CVE-2026-32202

Zero-click forced authentication: viewing a folder with the crafted .lnk triggers UNC resolution during icon render, coercing the victim into an attacker-directed outbound connection that leaks and enables relay of their Net-NTLMv2 credentials. Emerged due to an incomplete patch of CVE-2026-21510...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Script Aggressor per Cobalt Strike Uno script Aggressor completo per Cobalt Strike che weaponizza ed esegue file LNK e Library-MS dannosi per la divulgazione di hash NTLMv2-SSP tramite SMB. Include tecniche di bypass per CVE-2025-24054. ⚠️ DISCLAIMER Questo strumento è solo a scop...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — Guida a CVE-2024-21413 Una guida completa alla room TryHackMe "Moniker Link": sfruttare la CVE-2024-21413, una vulnerabilità di Microsoft Outlook del 2024, per rubare l'hash NTLMv2 della vittima nel momento in cui fa clic su un link in un'email di phishing — senza macro,...

CVE-2025-24054

Windows Datei-Explorer Zero-Click NTLMv2-SSP Hash-Offenlegung 🎥 Demonstrations-PoC + März 2025 Patch-Bypass 🎥 Patch-Bypass Klicken Sie auf das Bild oben, um die Demonstration der Sicherheitslücke anzusehen 📋 Technische Übersicht Dieses Repository bietet einen umfassenden Forschungsrahmen zur...

CVE-2023-23397

CVE-2023-23397 Ausnutzungs- & Mitigations-Demo 📌 Übersicht Dieses Projekt demonstriert die Erkennung, Ausnutzung und Abwehr von CVE-2023-23397 , einer kritischen Zero-Click-NTLM-Relay-Schwachstelle in Microsoft Outlook für Windows. Diese Schwachstelle wird über Kalendereinladungen ausgenutzt und...

CVE-2023-23397

CVE-2023-23397 Prova di Concetto Questa è una prova di concetto PoC per CVE-2023-23397, una vulnerabilità nel client Windows Microsoft Outlook. Prerequisiti Python 3 Pacchetto pywin32 Come usare Windows 1. Installa il pacchetto pywin32 richiesto eseguendo pip install pywin32. 2. Esegui lo script...

CVE-2024-21413-Moniker-Link-Writeup

CVE-2024-21413 – Analisi della vulnerabilità Moniker Link Questa repository contiene un'analisi tecnica della CVE-2024-21413 , una vulnerabilità relativa alla gestione dei Moniker Links in Microsoft Outlook che consente agli attaccanti di bypassare la Protected View e di divulgare credenziali...

CVE-2026-32202

Disclaimer Questo strumento è destinato esclusivamente a red teaming autorizzato e penetration testing. L'uso non autorizzato contro sistemi senza permesso esplicito è illegale. Usalo a tuo rischio. L'autore non si assume alcuna responsabilità per usi impropri o danni. Descrizione Coercizione di...