CVE-2026-104043

A flaw exists in SSSD where a local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow . By sending a specially crafted request with an undersized packet header, the attacker can cause an out-of-bounds memory read during packet parsing. Th...

CVE-2026-104042

A vulnerability exists in sssd where a local attacker can trigger a Denial of Service (DoS) . The flaw is caused by an out-of-bounds read (CWE-125) occurring when the service processes a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token sent to th...

CVE-2026-104041

A flaw exists in SSSD where an unprivileged local user can trigger a Denial of Service (DoS) via unbounded negative cache growth. By repeatedly requesting lookups for nonexistent entries through the Name Service Switch (NSS) responder , an attacker can cause the negative cache to grow without lim...

CVE-2026-104039 Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder

A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...

CVE-2026-104039

A flaw in SSSD allows a local user to cause a denial of service (DoS) by disrupting system authentication services. The issue occurs within the Pluggable Authentication Module (PAM) responder when handling GSSAPI authentication . Specifically, the cached connection state is freed upon completion ...

CVE-2026-104037

A vulnerability exists in SSSD where a local attacker can trigger a denial of service (DoS) . By sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket , the attacker can cause an integer underflow and an out-of-bounds memory read . This flaw leads t...

EUVD-2026-92895

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...

CVE-2026-104037 Sssd: sssd: denial of service via packet length underflow in autofs responder

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...

CVE-2026-104035

A flaw in the SSSD (System Security Services Daemon) within the Kerberos Credential Manager (KCM) responder allows for a Denial of Service (DoS) . A local user can trigger this by maintaining a persistent connection and repeatedly storing and destroying credentials. The root cause is that the ser...

CVE-2026-104034

A use-after-free vulnerability exists in SSSD within the Kerberos Credential Manager (KCM) responder . The flaw occurs during Kerberos ticket-granting ticket (TGT) renewal when a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerbero...

CVE-2026-104031

A flaw exists in SSSD where the autofs responder service fails to release memory allocated during successful request processing until the client connection terminates. A local attacker can exploit this by maintaining an open connection and submitting repeated valid requests, resulting in memory e...

CVE-2026-104029

A flaw in SSSD allows a local attacker to trigger a denial of service (DoS) . By sending a specially crafted request to the autofs responder UNIX socket , an attacker can exploit an out-of-bounds memory read caused by improper buffer offset calculation during request parsing. This vulnerability r...

EUVD-2026-92764

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...

Responder

Responder Responder 는 LLMNR, NBT-NS 및 MDNS 중독자로, HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS 등에 내장된 rogue 인증 서버를 제공합니다. NTLMv1/NTLMv2/LMv2, 확장 보안 NTLMSSP 및 15개 이상의 프로토콜에 걸친 다양한 인증 방식을 지원합니다. 목차 개요 새로운 기능 설치 빠른 시작 네트워크 중독 Rogue 서버 설정 macOS 문제 해결 개요 Responder는 LLMNR, NBT-NS 및 MDNS 이름 확인 요청에 응답하여 자격...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

Security update for sssd

This update for sssd fixes the following issues: CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925. CVE-2026-12610: cancelled or completed PAM request while the asynchronous...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

Nac_Bypass_Agent

Nac 우회 에이전트 이 코드는 Python으로 작성되었으며 Kali Linux에서 실행되도록 설계된 스크립트입니다. 다음은 각 함수가 수행하는 작업을 설명하는 요약입니다: runcommandcommand: 이 함수는 입력으로 받은 명령을 실행하고 그 출력을 반환합니다. killnetworkservices: 이 함수는 dhclient 및 NetworkManager 서비스를 중지합니다. getnetworkinfo: 이 함수는 tcpdump를 사용하여 네트워크 트래픽을 수신하고, 첫 번째로 캡처된 IP 및 MAC 주소를 반환합니다...

Bad-Pdf

Bad-Pdf Bad-PDF는 Windows 머신에서 NTLMNTLMv1/NTLMv2 해시를 탈취하기 위해 악성 PDF 파일을 생성합니다. 이 도구는 Checkpoint 팀이 공개한 취약점을 활용하여 악성 PDF 파일을 생성합니다. Bad-Pdf는 Responder 리스너를 사용하여 NTLM 해시를 읽어옵니다. 이 방법은 모든 PDF 리더모든 버전에서 작동합니다 대부분의 EDR/엔드포인트 솔루션이 이 공격을 탐지하지 못합니다. 참고 :...

kcmdump

KCM dumper SSSD에서 사용하는 KCM 데이터베이스를 덤프하고 CCACHE 형식의 Kerberos 티켓을 복구하는 간단한 스크립트입니다. 처음에는 SSSDKCMExtractor와 KCMTicketFormatter를 기반으로 합니다. 설명 버전 2.0.02018-08-13부터 SSSD의 KCM 응답자의 백엔드 저장소는 더 이상 데이터베이스 콘텐츠를 암호화하지 않습니다. 그러나 여전히 LDB 데이터베이스그 자체는 TDB 기반에 의존하므로 LDAP 유사 쿼리를 사용하여 쉽게 검색할 수 있습니다. SSSD는 Kerberos...