792 matches found
noPac
noPac CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. Yet another low effort domain user to domain admin exploit. If a Domain Controller is vulnerable it will return a TGT without a PAC, all eyes on small size tickets. Mitigation Patch your Domain Controllers! Credits Charlie Clark for his...
pois0nSword
pois0nSword In development, not currently useful for users. pois0nSword is an iOS project with the goal of eventually enabling user interface customization. Currently a demonstration of arbitrary webcontent read write using cve-2025-43529 on iOS 26.1. As well as a PAC bypass utilizing...
noPac-detection
About Detection script for CVE-2021-42278 and CVE-2021-42287 Usage The detection script uses the domain account credentials to determine the possibility of the vulnerabilities. usage: noPac-detection.py -h -debug -dc-ip -targetUser credentials optional arguments: -h, --help show this help message...
pacpoc
PACPoC: A local PoC exploit for CVE-2019-2205 To try out this exploit install the "malicious" app PacTest.apk and make exploit.pac available over http with, for example python -m SimpleHTTPServer. Then go to proxy settings on an Android device, select proxy autoconfig, and enter the URL to...
bbs
BBS The old bbs can be found here Description bbs is a router for SOCKS and HTTP proxies. It exposes SOCKS5, HTTP CONNECT or port forwarding services and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script if built...
CVE-2026-20700
dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...
WebKit-UAF-ANGLE-OOB-Analysis
WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 Notes and PoC material for a WebKit/ANGLE chain on iOS 26.1. This is not a full exploit; it separates verified primitives from the pieces that still fail. Author: zeroxjf Based on: jir4vv1t's CVE-2025-43529 exploit Status: Partial chain...
CVE-2026-65330
CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...
NoPacScan
NoPacScan NoPacScan is a CVE-2021-42287/CVE-2021-42278 Scanner,it scan for more domain controllers than the original script, and more accurate than it.It scan DC with DNS search msdcs.aaa.com,it's better than LDAP and SAMR, and it will automatically scan all DC we find.If you use LDAP or SAMR...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests
A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...
cve-2025-53779-kerberos_bypass_reproduction
CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass CVSS Score: 9.8 Critical Status: Active exploitation in the wild Disclosure: Microsoft August 2025 Patch Tuesday Zero-Day Overview CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protoc...
CLEANSTART-2024-AC14298 PAC parsing in MIT Kerberos 5 (aka krb5) before 1
CVE-2022-42898 affects multiple packages. PAC parsing in MIT Kerberos 5 aka krb5 before 1. See references for individual vulnerability details...
Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc (crlsa-2021_5142)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20215142 advisory. samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets CVE-2020-25719 Tenable has extracted the preceding description block directly from the...
Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc (crlsa-2022_8638)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228638 advisory. krb5: integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the CIQ security advisory...