PetitPotam-notest

Détection d'attaques par relais NTLM PetitPotam Un package Zeek pour détecter certaines tentatives de déclenchement d'attaques par relais NTLM via l'exploit Petit Potam. Ce package détecte ce qui semble être des tentatives d'exploitation réussies et échouées. Il fait la distinction entre elles en...

PetitPotam

Detecção de Ataques de Relay NTLM PetitPotam Um pacote Zeek para detectar algumas tentativas de acionar ataques de relay NTLM por meio do exploit Petit Potam. Este pacote detectará o que parecem ser tentativas de exploit bem-sucedidas e malsucedidas. Ele faz uma distinção entre elas examinando o...

ADCSPwn

ADCSPwn Uma ferramenta para escalar privilégios em uma rede Active Directory, coagindo a autenticação de contas de máquinas Petitpotam e retransmitindo para o serviço de certificados. Uso Execute ADCSPwn na sua rede alvo. root@kitploit: Author: @batsec - MDSec ActiveBreach Contributor: @Flangvik ...

PetitPotam

PetitPotam Strumento PoC per costringere host Windows ad autenticarsi verso altre macchine tramite MS-EFSRPC EfsRpcOpenFileRaw o altre funzioni : Gli strumenti utilizzano la named pipe LSARPC con interfaccia c681d488-d850-11d0-8c52-00c04fd90f7e perché è più diffusa. Ma è possibile attivarlo anche...

CVE-2025-33073-checker

Script de vérification CVE-2025-33073 Ce script de vérification PoC approximatif teste des cibles pour la vulnérabilité CVE-2025-33073 en tentant d'effectuer des attaques de réflexion NTLM via une coercition d'authentification NTLM via le RPC de Samba. Pour ce faire, vous devez disposer d'un comp...

cupntlm-Automated-Exploit-For-CVE-2025-33073-

cupntlm CVE-2025-33073 — تجاوز انعكاس NTLM عبر إكراه DNS أداة استغلال مؤتمتة لبيئات Active Directory. نظرة عامة يقوم cupntlm بأتمتة سلسلة هجوم انعكاس/تتابع NTLM التي تستغل CVE-2025-33073. يجمع بين حقن سجلات DNS، وإكراه المصادقة القسري PetitPotam، وتتابع NTLM في سير عمل واحد. تدعم الأداة وضعين...

Metasploit Weekly Wrap-Up

Wowza, a new credential gatherer and login scanner! This week Metasploit Framework gained a credential gatherer for Wowza Streaming Engine Manager. Credentials for this application are stored in a file named admin.password in a known location and the file is readable by default by BUILTIN\Users o...

Exploit for CVE-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply resear...

Exploit for CVE-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply resear...

DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method

PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot method and probably more but am lazy and its just PoC :P . Documentation: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Inspired by: PetitPotam @topotam77...

New NTLM Relay Attack Lets Attackers Take Control Over Windows Domain

A new kind of Windows NTLM relay attack dubbed DFSCoerce has been uncovered that leverages the Distributed File System DFS: Namespace Management Protocol MS-DFSNM to seize control of a domain. "Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service...

Metasploit Weekly Wrap-Up

PetitPotam Improvements Metasploit’s Ruby support has been updated to allow anonymous authentication to SMB servers. This is notably useful while exploiting the PetitPotam vulnerability with Metasploit, which can be used to coerce a Domain Controller to send an authentication attempt over SMB to...

Microsoft Patch Tuesday May 2022: Edge RCE, PetitPotam LSA Spoofing, bad patches

Hello everyone! This episode will be about Microsoft Patch Tuesday for May 2022. Sorry for the delay, this month has been quite intense. As usual, Im using my Vulristics project and going through not only the vulnerabilities that were presented on May 10th, but all the MS vulnerabilities presente...

Update now! Microsoft releases patches, including one for actively exploited zero-day

Microsoft has released patches for 74 security problems, including fixes for seven “critical” vulnerabilities, and an actively exploited zero-day vulnerability that affects all supported versions of Windows. First, well look at the actively exploited zero-day. Then well discuss two zero-days that...

Microsoft Patch Tuesday, May 2022 Edition

Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This months patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows. By all...

PT-2022-3135 · Microsoft · File Server Shadow Copy Agent Service +1

Name of the Vulnerable Software and Affected Versions: Microsoft File Server Shadow Copy Agent Service RVSS affected versions not specified Description: The issue is related to insufficient access restrictions in the Microsoft File Server Shadow Copy Agent Service RVSS, which can be exploited by ...

Dropping Files on a Domain Controller Using CVE-2021-43893

On December 14, 2021, during the Log4Shell chaos, Microsoft published CVE-2021-43893, a remote privilege escalation vulnerability affecting the Windows Encrypted File System EFS. The vulnerability was credited to James Forshaw of Google Project Zero, but perhaps owing to the Log4Shell atmosphere,...

Metasploit Wrap-Up

Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...

PetitPotam

Coerce an authentication attempt over SMB to other machines via MS-EFSRPC methods. Module Options msf use auxiliary/scanner/dcerpc/petitpotam msf auxiliarypetitpotam show actions ...actions... msf auxiliarypetitpotam set ACTION msf auxiliarypetitpotam show options ...show and set options... msf...

MultiPotato - Another Potato to get SYSTEM via SeImpersonate privileges

First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the code can be...