lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as...

Responder

Responder Responder is a LLMNR, NBT-NS, and MDNS poisoner with built-in rogue authentication servers for HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS, and more. It supports NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP, and various authentication methods across 15+ protocols. Table of Contents...

cve-2023-23397

CVE-2023-23397 This script allows to create TNEF-encoded Outlook e-mails with CVE-2023-23397 exploit payload and send them via pure SMTP - no need in COM objects or EWS. I could not get IPM.Schedule.Meeting.Request message class to work properly it generates both meeting and the reminder but does...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

LeakedWallpaper

Leaked Wallpaper This is a privilege escalation tool fixed with CVE-2024-38100 in KB5040434 that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user. Usage .\LeakedWallpaper.exe \\c$\1.jpg -downgrade Example...

CVE-2023-23397-PoW

CVE-2023-23397-PoW Proof of Work of CVE-2023-23397 for vulnerable Microsoft Outlook client application. For educational and research puproses only. CVE-2023-23397 preview This CVE aimed to retrieve NetNTLM hash logged in user from Microsoft Outlook client version 2016 except last patched version...

Firework

⚠️ NOTE: This tool is no longer under active maintenance. Firework Firework is a proof of concept tool to interact with Microsoft Workplaces creating valid files required for the provisioning process. The tool also wraps some code from Responder to leverage its ability to capture NetNTLM hashes...

Farmer

Farmer Author: @domchell Overview I wanted to be a farmer, so I started harvesting hashes Farmer is a project for collecting NetNTLM hashes in a Windows domain. Farmer achieves this by creating a local WebDAV server that causes the WebDAV Mini Redirector to authenticate from any connecting client...

Get-NetNTLM

Get-NetNTLM Powershell module to get the NetNTLMv2 hash of the current user Example Usage: PS C: Get-NetNTLM-Hash Administrator::desktop:1122334455667788:4FFFB35....F18337AB10:0101000000000000BD526...4006F0072006D000000000000000000...

evil-ssdp

Resumen Esta herramienta responde a solicitudes de descubrimiento multicast SSDP, haciéndose pasar por un dispositivo UPNP genérico. Tu dispositivo suplantado aparecerá mágicamente en el Explorador de Windows en las máquinas de tu red local. Los usuarios que sean tentados a abrir el dispositivo...

EUVD-2021-16051

Malware in sbrugna...

EUVD-2016-6117

Malware in sbrugna...

CVE-2021-29416

An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB...

BADPDF Malicious PDF Creator

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BADPDF Malicious PDF Creator', 'Description' = ' This module can either creates a blank PDF file which contains a UNC link which can be used to...

Microsoft Word UNC Path Injector

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Gems for extracting files require 'zip' Project for creating files require 'rex/zip' class MetasploitModule 'Microsoft Word UNC Path Injector', 'Description' = %q This...

Exploit for Improper Input Validation in Microsoft

CVE-2023-23397-PoW Proof of Work of CVE-2023-23397 for vulnera...

Metasploit Weekly Wrap-Up 02/16/2024

New Fetch Payload It has been almost a year since Metasploit released the new fetch payloads and since then, 43 of the 79 exploit modules have had support for fetch payloads. The original payloads supported transferring the second stage over HTTP, HTTPS and FTP. This week, Metasploit has expanded...

OPSEC failures when threat hunting

Over the last few years I’ve carried out a lot of phishing, and have some interesting observations on how organisations respond. However, the purpose of this blog is to highlight a worrying and amusing trend in response actions taken by the blue team and researchers when threat hunting a phishing...

SUSE CVE-2016-5166

The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and condu...