643 matches found
ridrelay
RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...
Bad-Pdf
Bad-Pdf Bad-PDF๋ Windows ๋จธ์ ์์ NTLMNTLMv1/NTLMv2 ํด์๋ฅผ ํ์ทจํ๊ธฐ ์ํด ์ ์ฑ PDF ํ์ผ์ ์์ฑํฉ๋๋ค. ์ด ๋๊ตฌ๋ Checkpoint ํ์ด ๊ณต๊ฐํ ์ทจ์ฝ์ ์ ํ์ฉํ์ฌ ์ ์ฑ PDF ํ์ผ์ ์์ฑํฉ๋๋ค. Bad-Pdf๋ Responder ๋ฆฌ์ค๋๋ฅผ ์ฌ์ฉํ์ฌ NTLM ํด์๋ฅผ ์ฝ์ด์ต๋๋ค. ์ด ๋ฐฉ๋ฒ์ ๋ชจ๋ PDF ๋ฆฌ๋๋ชจ๋ ๋ฒ์ ์์ ์๋ํฉ๋๋ค ๋๋ถ๋ถ์ EDR/์๋ํฌ์ธํธ ์๋ฃจ์ ์ด ์ด ๊ณต๊ฒฉ์ ํ์งํ์ง ๋ชปํฉ๋๋ค. ์ฐธ๊ณ :...
got-responded
root@kitploit: | |/ \ | | | | | || || |/ | \ | || \ | || \ | | || || |||| \ | | -.-. | || || | || | || \ ||/ || ||\|||||| /|/||/|||/ Author: @wm A simple tool to detect NBT-NS and LLMNR spoofing and messing with them a bit What is it? Pentesters, Redteamers and even real attackers love to...
atomic-red-team
Atomic Red Team Atomic Red Teamโข is a library of tests mapped to the MITRE ATT&CKยฎ framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...
kcmdump
KCM dumper SSSD ใไฝฟ็จใใ KCM ใใผใฟใใผในใใใณใใใKerberos ใใฑใใใ CCACHE ๅฝขๅผใงๅพฉๅ ใใ็ฐกๅใชในใฏใชใใใงใใ ๅฝๅใฏ SSSDKCMExtractor ใจ KCMTicketFormatter ใซๅบใฅใใฆใใพใใ ่ชฌๆ ใใผใธใงใณ 2.0.0๏ผ2018-08-13๏ผไปฅ้ใSSSD ใฎ KCM ใฌในใใณใใฎใใใฏใจใณใในใใฌใผใธใฏใใใผใฟใใผในใฎๅ ๅฎนใๆๅทๅใใชใใชใใพใใใใใ ใใไพ็ถใจใใฆ LDB ใใผใฟใใผใน๏ผใใ่ชไฝใฏ TDB ใซๅบใฅใ๏ผใซไพๅญใใฆใใใLDAP ใฉใคใฏใชใฏใจใชใง็ฐกๅใซๆค็ดขใงใใพใใ SSSD ใฏ Kerberos...
Responder
Responder Responder ๋ LLMNR, NBT-NS ๋ฐ MDNS ์ค๋ ์๋ก, HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS ๋ฑ์ ๋ด์ฅ๋ rogue ์ธ์ฆ ์๋ฒ๋ฅผ ์ ๊ณตํฉ๋๋ค. NTLMv1/NTLMv2/LMv2, ํ์ฅ ๋ณด์ NTLMSSP ๋ฐ 15๊ฐ ์ด์์ ํ๋กํ ์ฝ์ ๊ฑธ์น ๋ค์ํ ์ธ์ฆ ๋ฐฉ์์ ์ง์ํฉ๋๋ค. ๋ชฉ์ฐจ ๊ฐ์ ์๋ก์ด ๊ธฐ๋ฅ ์ค์น ๋น ๋ฅธ ์์ ๋คํธ์ํฌ ์ค๋ Rogue ์๋ฒ ์ค์ macOS ๋ฌธ์ ํด๊ฒฐ ๊ฐ์ Responder๋ LLMNR, NBT-NS ๋ฐ MDNS ์ด๋ฆ ํ์ธ ์์ฒญ์ ์๋ตํ์ฌ ์๊ฒฉ...
CVE-2025-24071-Exploit
CVE-2025-24071-Exploit ใใใฏๅญฆ็ฟ็ฎ็ใฎใฟใฎ่ณๆใงใใๅ่ใจใใฆใฎใฟใ่ฆงใใใ ใใ่ญฆๅฏใซ้ฃ็ตกใใชใใงใใ ใใใ ใใฎใณใณใใณใใฏๆ่ฒ็ฎ็ใฎใฟใงใใๅ่็จใจใใฆใฎใฟไฝฟ็จใใ่ญฆๅฏใซใฏ้ฃ็ตกใใชใใงใใ ใใใ ่ๅผฑๆงใฎ่ฉณ็ดฐ CVE ID : CVE-2025-24071 ่ๅผฑๆงใฎใใใทในใใ : RAR/ZIPๆฝๅบใใใณ.library-msใใกใคใซใไปใใNTLMใใใทใฅๆผๆดฉ ็ฐๅข JDK : 22 ๆปๆ ๆปๆ่ : ๆปๆ่ ใฎIPใๆๅฎใใฆpocใๅฎ่กใใexploit.zipใใกใคใซใ็ๆใใ ๆปๆ่ : sudo responder -I eth0 -v ่ขซๅฎณ่ :...
CVE-2026-90995
A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...
CVE-2026-90994
A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...
CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
DEBIAN-CVE-2026-90463
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...
CVE-2026-90463
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...
CVE-2026-90996 Sssd: sssd: denial of service in nss responder via crafted zero-length requests
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
EUVD-2026-77590
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
CVE-2026-90996
sssd (System Security Services Daemon) is vulnerable to a denial-of-service condition in its NSS (Network Security Services) responder . A local unprivileged user can send a specially crafted request with a zero-length body , causing the NSS responder to become unstable or terminate, degrading th...
EUVD-2026-77589
A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...
CVE-2026-90995
A NULL pointer dereference in the PAM responder of SSSD (System Security Services Daemon) allows a local attacker with access to the PAM responder socket to trigger a crash. The flaw is triggered when the pam_app_services configuration is enabled and the service item is omitted from a crafted pro...
CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
CVE-2026-90995 Sssd: sssd: local denial of service due to null pointer dereference in pam responder
A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...
EUVD-2026-77588
A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...