ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

Bad-Pdf

Bad-Pdf Bad-PDF는 Windows 머신에서 NTLMNTLMv1/NTLMv2 해시를 탈취하기 위해 악성 PDF 파일을 생성합니다. 이 도구는 Checkpoint 팀이 공개한 취약점을 활용하여 악성 PDF 파일을 생성합니다. Bad-Pdf는 Responder 리스너를 사용하여 NTLM 해시를 읽어옵니다. 이 방법은 모든 PDF 리더모든 버전에서 작동합니다 대부분의 EDR/엔드포인트 솔루션이 이 공격을 탐지하지 못합니다. 참고 :...

got-responded

root@kitploit: | |/ \ | | | | | || || |/ | \ | || \ | || \ | | || || |||| \ | | -.-. | || || | || | || \ ||/ || ||\|||||| /|/||/|||/ Author: @wm A simple tool to detect NBT-NS and LLMNR spoofing and messing with them a bit What is it? Pentesters, Redteamers and even real attackers love to...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

kcmdump

KCM dumper SSSD が使用する KCM データベースをダンプし、Kerberos チケットを CCACHE 形式で復元する簡単なスクリプトです。 当初は SSSDKCMExtractor と KCMTicketFormatter に基づいています。 説明 バージョン 2.0.0（2018-08-13）以降、SSSD の KCM レスポンダのバックエンドストレージは、データベースの内容を暗号化しなくなりました。ただし、依然として LDB データベース（それ自体は TDB に基づく）に依存しており、LDAP ライクなクエリで簡単に検索できます。 SSSD は Kerberos...

Responder

Responder Responder 는 LLMNR, NBT-NS 및 MDNS 중독자로, HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS 등에 내장된 rogue 인증 서버를 제공합니다. NTLMv1/NTLMv2/LMv2, 확장 보안 NTLMSSP 및 15개 이상의 프로토콜에 걸친 다양한 인증 방식을 지원합니다. 목차 개요 새로운 기능 설치 빠른 시작 네트워크 중독 Rogue 서버 설정 macOS 문제 해결 개요 Responder는 LLMNR, NBT-NS 및 MDNS 이름 확인 요청에 응답하여 자격...

CVE-2025-24071-Exploit

CVE-2025-24071-Exploit これは学習目的のみの資料です。参考としてのみご覧いただき、警察に連絡しないでください。 このコンテンツは教育目的のみです。参考用としてのみ使用し、警察には連絡しないでください。 脆弱性の詳細 CVE ID : CVE-2025-24071 脆弱性のあるシステム : RAR/ZIP抽出および.library-msファイルを介したNTLMハッシュ漏洩 環境 JDK : 22 攻撃 攻撃者 : 攻撃者のIPを指定してpocを実行し、exploit.zipファイルを生成する 攻撃者 : sudo responder -I eth0 -v 被害者 :...

CVE-2026-90995

A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90996

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

DEBIAN-CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90996 Sssd: sssd: denial of service in nss responder via crafted zero-length requests

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

EUVD-2026-77590

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

CVE-2026-90996

sssd (System Security Services Daemon) is vulnerable to a denial-of-service condition in its NSS (Network Security Services) responder . A local unprivileged user can send a specially crafted request with a zero-length body , causing the NSS responder to become unstable or terminate, degrading th...

EUVD-2026-77589

A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...

CVE-2026-90995

A NULL pointer dereference in the PAM responder of SSSD (System Security Services Daemon) allows a local attacker with access to the PAM responder socket to trigger a crash. The flaw is triggered when the pam_app_services configuration is enabled and the service item is omitted from a crafted pro...

CVE-2026-90996

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

CVE-2026-90995 Sssd: sssd: local denial of service due to null pointer dereference in pam responder

A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...

EUVD-2026-77588

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...