Prox-Ez

Prox-Ez：HTTP 认证的瑞士军刀 这个 HTTP 代理会代表你处理所有 HTTP 认证。 它支持 NTLM EPA（通道绑定和服务绑定）、Kerberos、哈希传递（pass-the-hash）、overpass-the-hash（密钥传递，pass-the-key）以及票据传递（pass-the-ticket，支持 TGT 和 TGS）。 相关文章： 深入剖析 NTLM EPA 并构建一个 MitM 代理 Windows HTTP 认证研究（第二部分） 安装 1. 安装依赖项 root@kitploit: $ In a venv $ python3 -m venv venv $...

AutoPtT

AutoPtT AutoPtTはKerberosチケットを列挙し、Pass-the-Ticket PtT 攻撃を対話的または段階的に実行します。これは、この攻撃においてRubeusやMimikatzに代わるスタンドアロンの代替手段であり、C、C++、Crystal、Python、Rustで実装されています。 以下のオプションを使用できます： auto - 自動Pass-the-Ticket攻撃 sessions - ログオンセッションの一覧表示。klist sessions の実行と同様 klist - 現在のセッションのチケット一覧表示。klist の実行と同様 tickets -...

Kerbeus-BOF

Kerbeus-BOF Kerberos 悪用のための Beacon Object Files。これは Rubeus プロジェクトの重要な機能の一部を C 言語で実装したものです。このプロジェクトは C2 フレームワーク Cobalt Strike、Havoc、AdaptixC2、Outflank C2 との統合を特徴としています。 チケットの要求と更新 asktgt asktgt アクションは、指定されたユーザーと暗号化キー（/rc4 または /aes256）に対して生の AS-REQ（TGT 要求）トラフィックを構築します。ハッシュの代わりに /password...

noPac

noPac 这个项目的由来是出于对 noPac 的原理学习, 在 cube0x0 的项目基础上进行了一些更改. 源码中添加了个人的理解注释. 删除了 Scan 功能, 个人觉得 Scan 功能用处比较鸡肋. 增加了 MachineAccountQuota 值的判断, 如果为 0 则退出程序. 优化了添加计算机帐户时的判断处理. 增加了 TGT 的输出. 漏洞的分析文章可以查看我的博客文章: noPac 分析 利用条件 noPac 是 CVE-2021-42278 sAMAccountName spoofing & CVE-2021-42287 deceiving the KDC...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

Active Directory Attacks Demystified: Pass-the-Hash (PtH), Pass-the-Ticket (PtT), and Beyond

Key Takeaways Active Directory attacks are identified as a significant threat in enterprise environments, with 74% of breaches involving compromised identities according to the Verizon DBIR 2025. Pass-the-Hash PtHattacks facilitate lateral movement by allowing the reuse of stolen NTLM hashes...

Metasploit Weekly Wrap-Up 08/02/2024

Metasploit goes to Hacker Summer Camp Next week, Metasploit will have demos at both Black Hat and DEF CON where the latest functionality from this year will be presented. The Black Hat demo will be on Thursday the 8th from 10:10 to 11:25 and the DEF CON demo will be on Saturday the 10th from 12:0...

Autobloody - Tool To Automatically Exploit Active Directory Privilege Escalation Paths Shown By BloodHound

autobloody is a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound. Description This tool automates the AD privesc between two AD objects, the source the one we own and the target the one we want if a privesc path exists in BloodHound database. The...

Abusing RDP’s Remote Credential Guard with Rubeus PTT

TL;DR Microsoft’s Remote Credential Guard RCG for RDP protects creds if an RDP server is compromised. It leaves little scope for password or NTLM credential dumping when a user connects to the server. It does however introduce workstation attack vectors. Abusing a user’s Kerberos token allows...

Mimikatz v2.2.0 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. But that's not all!...

Abusing Windows Security: mimikatz

mimikatz is well known tool for extraction of plaintexts passwords, hashes, PIN codes and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. A lot of times after the initial exploitation phase attackers may want to get a firmer foothold...

Microsoft Windows Kerberos - 'Pass The Ticket' Replay Security Bypass

source: https://www.securityfocus.com/bid/42435/info The Microsoft Windows implementation of Kerberos is prone to a security-bypass vulnerability. Successful exploits may allow attackers to gain unauthorized access to affected computers through replay attacks...