cnc-relay

cnc-relay أثناء تمارين الفريق الأحمر، من الشائع إعداد بنية تحتية للترحيل لفصل بصمتك الخارجية المواجهة للإنترنت عن الواجهة الخلفية الفعلية للقيادة والتحكم. بعض الخيارات الخفيفة الشائعة هي إعداد HAProxy أو NGINX على بنية تحتية سحابية مؤقتة وتوجيه حركة المرور إلى مضيف داخلي و/أو آمن حيث يمكن للمشغّل...

printerbugnew

Pure RPC over TCP プリンタスプーラートリガー Windows 11 22H2+ / Windows Server 2025 向け 使用方法 root@kitploit: printerbugnew.py username password domain attackerhost tcpport 使用例 匿名接続 root@kitploit: printerbugnew.py 192.168.1.100 資格情報を使用 root@kitploit: printerbugnew.py 192.168.1.100 admin Password123 DOMAIN...

ridrelay

RidRelay Moyen rapide et simple d'obtenir des noms d'utilisateurs de domaine sur un réseau interne. Contactez-moi : @skorov8 Comment ça fonctionne RidRelay combine l'attaque par relais NTLM, les requêtes courantes basées sur lsarpc et le cyclage de RID pour obtenir une liste de noms d'utilisateur...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

ADCSPwn

ADCSPwn A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts Petitpotam and relaying to the certificate service. Usage Run ADCSPwn on your target network. root@kitploit: Author: @batsec - MDSec ActiveBreach Contributor: @Flangvik - TrustedSec...

smbAutoRelay

DISCLAIMER : I AM NOT RESPONSIBLE OF THE MISUSE OF THIS TOOL. YOU RUN IT AT YOUR OWN RISK. Before running it, make sure you are in a controlled environment, and where you are allowed to perform this kind of exercise. PLEASE BE KIND : SMB AutoRelay SMB AutoRelay provides the automation of SMB/NTLM...

CVE-2026-15937

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

Ivanti-EPM-Coercion-Vulnerabilities

Vulnérabilités de coercition Ivanti EPM Preuves de concept pour Ivanti EPM CVE-2024-13159 et autres, permettant la coercition non authentifiée des identifiants de la machine Ivanti EPM pour une utilisation dans des attaques par relais. Article de blog Analyse approfondie ici :...

ExchangeRelayX

ExchangeRelayX Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking...

CVE-2026-15937 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

smbtakeover

smbtakeover Une technique pour dissocier et réassocier le port 445/tcp sur Windows sans charger de pilote, charger un module dans LSASS, ni redémarrer la machine cible. Implémentée pour alléger la charge des relais NTLM basés sur SMB lors d'opérations via un C2. L'analyse technique de la techniqu...

CVE-2023-23397

برنامج PoC بسيط بلغة PowerShell لـ CVE-2023-23397 CVE-2023-23397 هي ثغرة أمنية في MS Outlook تسمح للمهاجم باستخراج تفاصيل مصادقة المستخدم. تتعلق الثغرة بقدرة المهاجم على تحديد مسار UNC في خاصية "ReminderSoundFile" داخل بريد إلكتروني / دعوة اجتماع - عندما يتم تشغيل التذكير في Outlook، يحاول عميل...

CVE-2022-30216

CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...

ZackAttack

ZackAttack! - إعادة توجيه NTLM كما لم يفعلها أحد من قبل ======= ما هذا بحق الجحيم؟ نسخة tl;dr - ZackAttack! هي مجموعة أدوات جديدة للقيام بإعادة توجيه مصادقة NTLM بشكل مختلف عن أي أداة أخرى موجودة حاليًا. = إذن كيف يختلف / يتفوق ZackAttack!؟ بالمقارنة مع الأدوات الأخرى... يدعم NTLMv2 : يُحدث تأثير...

ntlm_relay_gat

NTLM Relay Gat Description NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines the process of exploiting NTLM relay vulnerabilities,...

ntlm_relay_gat

NTLM Relay Gat الوصف NTLM Relay Gat هي أداة قوية مصممة لأتمتة استغلال هجمات NTLM Relay باستخدام ntlmrelayx.py من مجموعة أدوات Impacket. من خلال الاستفادة من إمكانيات ntlmrelayx.py، تعمل NTLM Relay Gat على تبسيط عملية استغلال ثغرات NTLM Relay، وتقدم مجموعة من الوظائف بدءًا من سرد مشاركات SMB إلى...

PowerPriv

PowerPriv DESCRIPTION A powershell implementation of PrivExchange by @dirkjan original code found here: https://github.com/dirkjanm/PrivExchange/blob/master/privexchange.py Useful for environments on which you cannot run python-based applications, have user credentials, or do not want to drop fil...

AzureC2Relay

AzureC2Relay AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will b...

PatrowlManager

Codacy Badge PatrOwl PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations scans, searches, API calls, ..., aggregating the results...

lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...