PetitPotam

PetitPotam Herramienta PoC para forzar a hosts Windows a autenticarse en otras máquinas a través de MS-EFSRPC EfsRpcOpenFileRaw u otras funciones : Las herramientas utilizan la tubería con nombre LSARPC con la interfaz c681d488-d850-11d0-8c52-00c04fd90f7e porque es más prevalente. Pero es posible...

PetitPotam-notest

Rilevamento attacchi NTLM Relay di PetitPotam Un pacchetto Zeek per rilevare alcuni tentativi di innescare attacchi NTLM relay tramite l'exploit Petit Potam. Questo pacchetto rileva quelli che sembrano essere tentativi di exploit riusciti e non riusciti. Distingue tra i due esaminando il codice d...

PetitPotam

Rilevamento di attacchi NTLM Relay PetitPotam Un pacchetto Zeek per rilevare alcuni tentativi di innescare attacchi NTLM relay tramite l'exploit Petit Potam. Questo pacchetto rileverà quelli che sembrano essere tentativi di exploit riusciti e non riusciti. Fa una distinzione tra loro esaminando i...

ADCSPwn

ADCSPwn Uma ferramenta para escalar privilégios em uma rede Active Directory, coagindo a autenticação de contas de máquinas Petitpotam e retransmitindo para o serviço de certificados. Uso Execute ADCSPwn na sua rede alvo. root@kitploit: Author: @batsec - MDSec ActiveBreach Contributor: @Flangvik ...

CVE-2025-33073-checker

CVE-2025-33073 Script di Verifica Questo script di verifica PoC approssimativo testa i target per la vulnerabilità CVE-2025-33073 tentando di eseguire attacchi di riflessione NTLM utilizzando la coercizione dell'autenticazione NTLM tramite Samba RPC; per farlo è necessario avere un account con...

cupntlm-Automated-Exploit-For-CVE-2025-33073-

cupntlm CVE-2025-33073 — تجاوز انعكاس NTLM عبر إكراه DNS أداة استغلال مؤتمتة لبيئات Active Directory. نظرة عامة يقوم cupntlm بأتمتة سلسلة هجوم انعكاس/تتابع NTLM التي تستغل CVE-2025-33073. يجمع بين حقن سجلات DNS، وإكراه المصادقة القسري PetitPotam، وتتابع NTLM في سير عمل واحد. تدعم الأداة وضعين...

Metasploit Weekly Wrap-Up

Wowza, a new credential gatherer and login scanner! This week Metasploit Framework gained a credential gatherer for Wowza Streaming Engine Manager. Credentials for this application are stored in a file named admin.password in a known location and the file is readable by default by BUILTIN\Users o...

Exploit for CVE-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply resear...

Exploit for CVE-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply resear...

DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method

PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot method and probably more but am lazy and its just PoC :P . Documentation: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Inspired by: PetitPotam @topotam77...

New NTLM Relay Attack Lets Attackers Take Control Over Windows Domain

A new kind of Windows NTLM relay attack dubbed DFSCoerce has been uncovered that leverages the Distributed File System DFS: Namespace Management Protocol MS-DFSNM to seize control of a domain. "Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service...

Metasploit Weekly Wrap-Up

PetitPotam Improvements Metasploit’s Ruby support has been updated to allow anonymous authentication to SMB servers. This is notably useful while exploiting the PetitPotam vulnerability with Metasploit, which can be used to coerce a Domain Controller to send an authentication attempt over SMB to...

Microsoft Patch Tuesday May 2022: Edge RCE, PetitPotam LSA Spoofing, bad patches

Hello everyone! This episode will be about Microsoft Patch Tuesday for May 2022. Sorry for the delay, this month has been quite intense. As usual, Im using my Vulristics project and going through not only the vulnerabilities that were presented on May 10th, but all the MS vulnerabilities presente...

Update now! Microsoft releases patches, including one for actively exploited zero-day

Microsoft has released patches for 74 security problems, including fixes for seven “critical” vulnerabilities, and an actively exploited zero-day vulnerability that affects all supported versions of Windows. First, well look at the actively exploited zero-day. Then well discuss two zero-days that...

Microsoft Patch Tuesday, May 2022 Edition

Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This months patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows. By all...

PT-2022-3135 · Microsoft · File Server Shadow Copy Agent Service +1

Name of the Vulnerable Software and Affected Versions: Microsoft File Server Shadow Copy Agent Service RVSS affected versions not specified Description: The issue is related to insufficient access restrictions in the Microsoft File Server Shadow Copy Agent Service RVSS, which can be exploited by ...

Dropping Files on a Domain Controller Using CVE-2021-43893

On December 14, 2021, during the Log4Shell chaos, Microsoft published CVE-2021-43893, a remote privilege escalation vulnerability affecting the Windows Encrypted File System EFS. The vulnerability was credited to James Forshaw of Google Project Zero, but perhaps owing to the Log4Shell atmosphere,...

Metasploit Wrap-Up

Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...

PetitPotam

Coerce an authentication attempt over SMB to other machines via MS-EFSRPC methods. Module Options msf use auxiliary/scanner/dcerpc/petitpotam msf auxiliarypetitpotam show actions ...actions... msf auxiliarypetitpotam set ACTION msf auxiliarypetitpotam show options ...show and set options... msf...

MultiPotato - Another Potato to get SYSTEM via SeImpersonate privileges

First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the code can be...