pacpoc

PACPoC: un exploit PoC local para CVE-2019-2205 Para probar este exploit, instala la aplicación "maliciosa" PacTest.apk y haz que exploit.pac esté disponible vía http con, por ejemplo, python -m SimpleHTTPServer. Luego ve a la configuración de proxy en un dispositivo Android, selecciona proxy...

bbs

BBS El antiguo bbs se puede encontrar aquí Descripción bbs es un enrutador para proxies SOCKS y HTTP. Expone servicios SOCKS5, HTTP CONNECT o redirección de puertos y reenvía las peticiones entrantes a proxies o cadenas de proxies según el destino de la petición. El enrutamiento se puede configur...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 Notas y material de PoC para una cadena WebKit/ANGLE en iOS 26.1. Esto no es un exploit completo; separa las primitivas verificadas de las piezas que aún fallan. Autor: zeroxjf Basado en: exploit de jir4vv1t para CVE-2025-43529 Estado:...

noPac

noPac CVE-2021-42287/CVE-2021-42278 扫描与利用工具。又一个低成本的域用户提权为域管理员漏洞利用。 如果域控制器存在漏洞，它将返回一个没有 PAC 的 TGT，请留意小尺寸票据。 缓解措施 请为您的域控制器打补丁！ 鸣谢 感谢 Charlie Clark 提供的 Rubeus 分支以及 Kevin Robertson 提供的 SharpMad。...

CVE-2026-20700

dyld-signing-oracle-poc Una exploración controlada del mecanismo de vinculación durante el page-in de dyld y de los chained fixups como oráculo de firma PAC, en el contexto de CVE-2026-20700. En arm64e, cada puntero a función está autenticado por hardware. El objetivo aquí es demostrar que se pue...

noPac-detection

关于 CVE-2021-42278和CVE-2021-42287的检测脚本 使用 The detection script uses the domain account credentials to determine the possibility of the vulnerabilities. usage: noPac-detection.py -h -debug -dc-ip -targetUser credentials optional arguments: -h, --help show this help message and exit -debug Turn DEBU...

pois0nSword

pois0nSword En desarrollo, actualmente no es útil para los usuarios. pois0nSword es un proyecto de iOS cuyo objetivo es permitir, eventualmente, la personalización de la interfaz de usuario. Actualmente es una demostración de lectura/escritura arbitraria de contenido web utilizando cve-2025-43529...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Bypass de autenticación de Kerberos en Microsoft Windows Puntuación CVSS: 9.8 Crítica Estado: Explotación activa en el mundo real Divulgación: Microsoft Patch Tuesday de agosto de 2025 día cero Resumen CVE-2025-53779 es una vulnerabilidad crítica de bypass de autenticación en la...

CVE-2026-65330

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...

NoPacScan

NoPacScan NoPacScan es un escáner para CVE-2021-42287/CVE-2021-42278, escanea más controladores de dominio que el script original y es más preciso que este. Escanea los DC mediante la búsqueda DNS msdcs.aaa.com, lo cual es mejor que LDAP y SAMR, y automáticamente escaneará todos los DC que...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CLSA-2026-1790104586 TuxCare security update for pac-resolver (1 CVE)

TuxCare rebuilt pac-resolver to address 1 CVE. Fixed in 4.2.0-tuxcare.1...

Astra Linux – Vulnerability in Heimdal, KRB5

PAC parsing in MIT Kerberos 5 also known as krb5 before versions 1.19.4 and 1.20.x before version 1.20.1 contains integer overflows that may lead to remote code execution in the KDC, kadmind, or a GSS or Kerberos application server on 32-bit platforms. This results in a heap-based buffer overflow...

CVE-2026-82776

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82777

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82778

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

CVE-2026-82778

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

CVE-2026-82778

CVE-2026-82778 affects the CONPROSYS PAC Series (a product line by Contec), where an information exposure through directory listing occurs. A remote unauthenticated attacker can access a specific URL to obtain the directory list without authentication. The CVSS 3.1 score is 4.3 (Medium) with low ...

EUVD-2026-77231

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...