CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

RAITrigger

RAITrigger The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. It turns out, that this function can be called from any low privileged user not to spawn a process but to trigger SYSTEM authentication to an...

SharpRelay

Usage The only requirement for this attack to work is to have a beacon with local administrator privileges or with the ability to load drivers. The attack using SharpRelay works as follows: Upload the signed WinDivert driver into any folder on the compromised host Run SharpRelay to modify the...

Potato

Potato Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012 How it works Potato takes advantage of known issues in Windows to gain local privilege escalation, namely NTLM relay specifically HTTP-SMB relay and NBNS spoofing. Using the techniques outlined below, it is possible for an...

PowerPriv

PowerPriv DESCRIPTION A powershell implementation of PrivExchange by @dirkjan original code found here: https://github.com/dirkjanm/PrivExchange/blob/master/privexchange.py Useful for environments on which you cannot run python-based applications, have user credentials, or do not want to drop fil...

StreamDivert

StreamDivert StreamDivert is a tool to man-in-the-middle or relay in and outgoing network connections on a system. It has the ability to, for example, relay all incoming SMB connections to port 445 to another server, or only relay specific incoming SMB connections from a specific set of source IP...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

CVE-2019-1040

CVE-2019-1040 Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote CVE-2019-1040.py for easy to use. You can also check out my exchange2domain repo: https://github.com/ridter/exchange2domain, another way to use exchange to get DC...

ExchangeRelayX

ExchangeRelayX Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking...

S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

KrbRelay

KrbRelay Relaying 3-headed dogs. More details at https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html and https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html This should be working on most fully patched Windows systems...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

ADCSPwn

ADCSPwn A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts Petitpotam and relaying to the certificate service. Usage Run ADCSPwn on your target network. Author: @batsec - MDSec ActiveBreach Contributor: @Flangvik - TrustedSec Contributor:...

PatrowlManager

Codacy Badge PatrOwl PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations scans, searches, API calls, ..., aggregating the results...

IBM BigFix Platform - Information Disclosure

IBM BigFix Platform 9.2 and 9.5 contains an information disclosure vulnerability caused by not enabling authenticated access in relay, letting remote attackers query and gather update and fixlet information, exploit requires no authentication. id: CVE-2019-4061 info: name: IBM BigFix Platform -...

hive

From WikiLeaks: Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware. Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a targe...

CVE-2025-33073

Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...

CVE-2025-55234

CVE-2025-55234 This vulnerability allows attackers to perform relay attacks against the SMB Server Message Block protocol. If successful, it can lead to Elevation of Privilege EoP essentially allowing unauthorized users to gain higher-level access on a system By Mark Mallia Issue This vulnerabili...

R2Socks

R2Socks SOCKS5 proxy tunneled through Cloudflare R2 buckets. Client App ◄─SOCKS5─► Proxy ◄─── R2 Bucket ───► Agent ◄─TCP─► Target The proxy runs a local SOCKS5 server on the operator's machine. Every CONNECT request is serialized as binary packets and stored as R2 objects. The agent polls the sam...

smbtakeover

smbtakeover A technique to unbind and rebind 445/tcp on Windows without loading a driver, loading a module into LSASS, or rebooting the target machine. Implemented to ease the burden of SMB-based NTLM relays while operating over C2. Technical analysis of the technique is dicussed in more detail...