dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

CVE-2026-121432

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

EUVD-2026-115854

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

Exploit for Authentication Bypass by Capture-replay in Microsoft

CVE-2026-62911 — Exchange MRSProxy Pre-Auth RCE Pre-authentic...

CVE-2019-1040-dcpwn

CVE-2019-1040-dcpwn Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote dcpwn.py for easy to use. Requirements These tools require impacket. You can install it from pip pip install impacket Usage usage: dcpwn.py -h -u USERNAME -p PASSWO...

CVE-2025-33073

Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...

CVE-2025-55234

CVE-2025-55234 This vulnerability allows attackers to perform relay attacks against the SMB Server Message Block protocol. If successful, it can lead to Elevation of Privilege EoP essentially allowing unauthorized users to gain higher-level access on a system By Mark Mallia Issue This vulnerabili...

smbtakeover

smbtakeover A technique to unbind and rebind 445/tcp on Windows without loading a driver, loading a module into LSASS, or rebooting the target machine. Implemented to ease the burden of SMB-based NTLM relays while operating over C2. Technical analysis of the technique is dicussed in more detail...

chuckle

Chuckle - An automated SMB Relay Script. Chuckle requires a few tools to work: SMBRelayX.py Veil latest version from git Responder Chuckle will detect which version you are using. Nmap Nbtscan unixwiz MSFconsole Usuage should be fairly simple, run as root or use sudo: sudo ./chuckle.sh Wait a whi...

CVE-2022-30216

CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 is a vulnerability in systems that allow NTLM authentication, a legacy protocol that can be exploited for credential relay attacks or brute force attacks. This vulnerability arises when NTLM is enabled, leaving systems susceptible to unauthorized...

blankspace

Blank Space Blank Space is a refactoring of James Forshaw's original proof of concept for CVE-2021-43893, EFSRPC arbitrary file upload privilege escalation. Blank Space can create arbitrary files on a remote host that is using unconstrained delegation if it isn't patched for CVE-2021-43893. File...

RAITrigger

RAITrigger The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. It turns out, that this function can be called from any low privileged user not to spawn a process but to trigger SYSTEM authentication to an...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

Exchange2domain

Exchange2domain All in One tools of privexchange . You only need to open the web server port, so no high privileges are required. Great writeup! Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket...

bleeding_onions

BleedingOnions Tracking the Exit and Guard relays edges of the Tor network for CVE-2014-0160. https://encrypted.redteam.net/bleedingonions/ Special thanks to: Stem, a python controller library for Tor https://stem.torproject.org/. Steffen Ullrich's perl script to check for CVE-2014-0160...

google_socks

This script is used to allow two sockets to communicate while relaying data through Google Drive. Check out this blog post for more details. Setup Process Install needed python modules see below Run "python2 ./googlesocks.py --setup" and follow the instructions Create a Google API Project Create...

CVE-2022-29593

CVE-2022-29593 - Authentication Bypass by Capture Replay Dingtian-DT-R002 Title Authentication Bypass by Capture-replay Published: Version: 1.0 Vendor: Shenzhen Dingtian Technologies Co.,Ltd Product: 2 Channel Relay Board/Relay Card Version affected: Firmware V3.1.276A Product - Dingtian DTR004 A...