182 matches found
nosferatu
nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...
SharpSCOM
SharpSCOM Una herramienta C para interactuar con Microsoft System Center Operations Manager SCOM. Esta herramienta ha sido probada contra la versión 10.22.10118.0 del servidor SCOM. La integración SSPI se proporciona a través de la librería nsspi de Kevin Thompson antiduh, publicada bajo la...
SSH-Stealer
RunAs-Stealer Capacidad inteligente de keylogging para robar credenciales SSH, incluida la contraseña y la clave privada. Uso Las credenciales robadas se escriben en la secuencia ADS log de C:\Users\Desktop\desktop.ini. Para obtener las credenciales, escriba el comando cmd: root@kitploit: more...
SCOMDecrypt
SCOMDecrypt - Herramienta de descifrado de credenciales de SCOM Publicado como código abierto por NCC Group Plc - http://www.nccgroup.trust/ Desarrollado por Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt Publicado bajo AGPL, consulta LICENSE...
CVE-2025-32462-POC
CVE-2025-32462 – sudo -h PoC de Escalada de Privilegios 🚨 Exploit de escalada de privilegios local para sudo mediante el argumento -h/--host Afecta a sistemas con configuraciones incorrectas de sudo que permiten acceso root no deseado. 🧠 Acerca de Este PoC demuestra CVE-2025-32462 , un fallo lógi...
PowerShell-Suite
PowerShell-Suite Hay grandes herramientas y recursos en línea para realizar casi cualquier tarea en PowerShell; sin embargo, a veces es necesario crear un script de utilidad para un propósito específico o para salvar una brecha ontológica. Esta es una colección de utilidades de PowerShell que arm...
RemoteMonologue
RemoteMonologue RemoteMonologue es una técnica de recolección de credenciales de Windows que permite comprometer usuarios de forma remota aprovechando la clave RunAs de usuario interactivo y forzando autenticaciones NTLM mediante DCOM. Lea el artículo RemoteMonologue: Armando DCOM para Coerciones...
RunAs-Stealer
RunAs-Stealer Stealer de credenciales de la utilidad RunAs que implementa 3 técnicas: Hooking de CreateProcessWithLogonW, Keylogging inteligente y Depuración remota Uso Los stealers se ejecutan en un bucle while el inyector también en el caso de Hooking en segundo plano; para finalizarlos usa el...
cisco-CVE-2023-20075
Acerca de Investigador de seguridad: ly1g3, ly1g3attuta.io Huella GPG: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Resumen: Escalada local de privilegios y escape de shell CVE: CVE-2023-20075 Cronología: Descubierto - ly1g3 Reportado - ly1g3 Corregido -...
poc-cve-2019-14287
PoC de CVE-2019-14287 Resumen Es un ejemplo que reproduce la vulnerabilidad de sudo CVE-2019-14287 en un contenedor Docker. Procedimiento del ejercicio 1. Levantar el contenedor con docker compose up -d 2. Entrar al contenedor con docker exec -it vulnerablesudoapp bash 3. Ejecutar los comandos...
Astra Linux – Vulnerability in sudo
In Sudo version 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a non-existent user by executing sudo with a numerical UID that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability, as executing a command via sudo a...
Astra Linux – Vulnerability in sudo
In Sudo version 1.8.29, the fact that a user has been blocked for example, by using the “!” character in the shadow file instead of a password hash was not taken into consideration. This allows an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The...
CVE-2026-14852
Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database...
MiracleLinux 7 : sudo-1.8.23-10.el7.3 (AXSA:2023-4846:02)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-4846:02 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...
MiracleLinux 9 : sudo-1.9.5p2-7.el9.1 (AXSA:2023-4872:03)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4872:03 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...
CVE-2001-1517
RunAs runas.exe in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying tha...
CVE-2001-1518
RunAs runas.exe in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service RunAs hang by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the...
BIT-WILDFLY-2022-0866
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...
