65 matches found
CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC
💻 CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC 🧩 Overview This project reproduces the MonikerLink behavior CVE-2024-21413 in a fully isolated TryHackMe environment to show how certain hyperlink formats can cause Outlook to process a link in a way that leaks...
NTLMRawUnHide
NTLMRawUnhide.py Autor : Mike Gualtieri Blog : https://www.mike-gualtieri.com Twitter : https://twitter.com/mlgualtieri GitHub : https://github.com/mlgualtieri/NTLMRawUnhide Artículo: https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol Introducción NTLMRawUnhide....
ntlm_theft
ntlmtheft Una herramienta para generar múltiples tipos de archivos de robo de hash NTLMv2. ntlmtheft es una herramienta Python3 de código abierto que genera 21 tipos diferentes de documentos de robo de hash. Se pueden utilizar para phishing cuando el objetivo permite el tráfico SMB fuera de su re...
CVE-2023-23397
CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...
CVE-2023-35636
CVE-2023-35636 Vulnerabilidad de divulgación de información de Microsoft Outlook filtración de hash de contraseña - Script POC en Expect CVE-2023-35636 es un exploit de la función de compartir calendario en Microsoft Outlook, mediante el cual agregar dos encabezados a un correo electrónico dirige...
CVE-2024-38200
CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...
tryhackme-monikerlink-writeup
TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full walkthrough of TryHackMe's "Moniker Link" room: weaponizing CVE-2024-21413, a 2024 Microsoft Outlook vulnerability, to steal a victim's NTLMv2 hash the moment they click a link in a phishing email — no macro, no attachment, no obvious...
CVE-2024-43451-POC
Descripción Nombre : CVE-2024-43451 Puntuación CVSSv3 : 6.5 Versiones afectadas : Todas las versiones de Microsoft Windows anteriores al parche de noviembre de 2024 CVE-2024-43451 es una vulnerabilidad de día cero en Microsoft Windows que permite a los atacantes capturar hashes de contraseñas...
impostor
Impostor SMB1 server for intercepting NTLMv2 Hashes, written in C. The goal of the project is to implement an SMB1 server as a state machine that correctly accepts and responds to client requests in order to deceive it, leading it to complete an NTLM authentication and thus reveal its own NTLMv2...
CVE-2026-33829-Writeup
CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...
NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vulnerability discovered by ? in WordPress Npm vite versions = 6.4.2...
GHSA-V6WH-96G9-6WX3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...
CVE-2026-39908
OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application...
CVE-2026-39908
OpenBullet2 ≤ v0.3.2 on Windows suffers a credential disclosure via a UNC-path proxy source. When a job loads proxies from an attacker-controlled UNC path, an SMB authentication occurs and reveals the NTLMv2 hash of the process user, enabling relay or offline cracking. Affected component is the p...
PT-2026-31734
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.4 Description SiYuan, a personal knowledge management system, prior to version 3.6.4, configured Mermaid.js with 'securityLevel: "loose"' and 'htmlLabels: true'. This configuration allowed tags with 'src' attribute...
CVE-2025-10285 Simplcity Device Manager exposes NTLMv2 hash
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password...
CVE-2025-35061
Newforma Info Exchange NIX '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account...
CVE-2025-35061
Newforma Info Exchange (NIX) is affected via the NPCSRemoteWeb/LegacyIntegrationServices.asmx endpoint. An unauthenticated remote attacker can cause NIX to initiate an SMB connection to a system under attacker control, enabling capture of the NTLMv2 hash of the NIX service account. This informati...
