nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

SCOMDecrypt

SCOMDecrypt - SCOM Credential Decryption Tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt Released under AGPL, see LICENSE for more information Introduction...

SharpSCOM

SharpSCOM A C tool for interacting with Microsoft System Center Operations Manager SCOM. This tool has been tested against SCOM Server version 10.22.10118.0. SSPI integration is provided via the nsspi library from Kevin Thompson antiduh released under the BSD-2 license. Command Line Usage █▀ █ █...

SSH-Stealer

RunAs-Stealer Smart keylogging capability to steal SSH Credentials including password & Private Key Usage The stolen credentials are written to C:\Users\Desktop\desktop.ini ADS log stream. To get the credentials type the cmd command: more \Desktop\desktop.ini:log" To remove the stored credentials...

PowerShell-Suite

PowerShell-Suite There are great tools and resources online to accomplish most any task in PowerShell, sometimes however, there is a need to script together a util for a specific purpose or to bridge an ontological gap. This is a collection of PowerShell utilities I put together either for fun or...

RemoteMonologue

RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...

CVE-2025-32462-POC

CVE-2025-32462 – sudo -h Privilege Escalation PoC 🚨 Local privilege escalation exploit for sudo via the -h/--host argument Affects systems with sudo misconfigurations allowing unintended root access. 🧠 About This PoC demonstrates CVE-2025-32462 , a logic flaw in sudo all versions ≤ 1.9.17, where...

RunAs-Stealer

RunAs-Stealer RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging Usage The stealers are running in a while loop the injector also in Hooking case in the background, to kill them use Task Manager. The stolen credentials...

cisco-CVE-2023-20075

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Local Privilege Escalation and Shell Escape CVE: CVE-2023-20075 Timeline: Discovered - ly1g3 Reported - ly1g3 Fixed - Cisco Cisco...

poc-cve-2019-14287

PoC of CVE-2019-14287 Overview This is a sample that reproduces the sudo vulnerability CVE-2019-14287 on a Docker container. Exercise Steps 1. Start the container with docker compose up -d 2. Enter the container with docker exec -it vulnerablesudoapp bash 3. Execute whoami and id commands to...

Astra Linux – Vulnerability in sudo

In Sudo version 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by executing sudo with a numerical UID that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability, as executing a command via sudo as...

Astra Linux – Vulnerability in sudo

In Sudo version 1.8.29, the fact that a user has been blocked for example, by using the “!” character in the shadow file instead of a password hash was not taken into consideration. This allows an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The...

Rocky Linux 8 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource (crlsa-2023_0284)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230284 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2023_0282)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230282 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

CVE-2026-14852

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database...

MiracleLinux 7 : sudo-1.8.23-10.el7.3 (AXSA:2023-4846:02)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-4846:02 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : sudo-1.9.5p2-7.el9.1 (AXSA:2023-4872:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4872:03 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...

CVE-2001-1517

RunAs runas.exe in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying tha...

CVE-2001-1518

RunAs runas.exe in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service RunAs hang by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the...

BIT-WILDFLY-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...