DragonCastle

DragonCastle AutodialDLLの横展開テクニックとSSPを組み合わせて、LSASSプロセスからNTLMハッシュを抽出するPoCです。 説明 ターゲットマシンにDLLをアップロードします。次に、リモートレジストリを有効にしてAutodialDLLエントリを変更し、BITSサービスを開始/再起動します。SvchostsはDLLをロードし、AutodialDLLをデフォルト値に戻してから、RPCリクエストを実行してLSASSに同じDLLをSecurity Support...

CVE-2024-38063

CVE-2024-38063 - SSP H3 このセットアップ（動画のもの）では、Windows 22H2 19045 とビルド 2468 を使用しました。（このCVEは4780までパッチが適用されていません） 私は Qemu/KVM でも試しましたが、ネットワークアダプタがパケットを合体（コアレッシング）しませんでした（tcpdump で調査した限りでは）。解決策は VirtualBox の Host-Only ネットワークを使用することでした。 いくつかの PoC を試しました（賢く、無理せずに）:...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

NX PIE SSP ASLRをバイパスするための このPoCは安定していません。 httpサービスがダウンすることがあります。 morecore-offsetを修正し、正しいlibc-fileを選択する必要があります。...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor スクリプト SMB NTLMv2-SSP ハッシュ漏洩のための悪意のある LNK ファイルおよび Library-MS ファイルを武器化し実行する、包括的な Cobalt Strike Aggressor スクリプトです。CVE-2025-24054 バイパス技術を含みます。 ⚠️ 免責事項 このツールは教育および研究目的のみに提供されています。作者は本コードの誤用に対して一切の責任を負いません。所有しているシステム、または明示的なテスト許可を得ているシステムでのみ使用してください。 NTLM...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM 漏洩 ブラウザからワンクリックでNTLMハッシュを漏洩させる新たな脆弱性 作成者: Ruben Enkaoua 説明 Microsoft ms-photos URIスキームはfileNameをパラメータとして受け取ります。このパラメータにUNCパスを指定すると、開いた際にNTLMv2-SSPハッシュが漏洩します。攻撃者は特別に細工されたリンクを作成することで、被害者をブラウザから直接Microsoft...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a memory leak in setsspcomplete. The memory leak was fixed in setsspcomplete, where the mgmtpendingcmd structures are not freed after they are removed from the pending list. Commit 302a1f674c00 “Bluetoot...

CVE-2026-46056

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...

CVE-2026-46056

The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: A memory leak occurs when the build ntlmssp negotiate blob operation fails. There is a memory leak when mounting CIFS shares: - Unreferenced object: 0xffff888166059600 size 448 Command: “mount.cifs”, PID: 51391, Jiffies:...

SUSE CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

UBUNTU-CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151 Bluetooth: MGMT: Fix memory leak in set_ssp_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151 Bluetooth: MGMT: Fix memory leak in set_ssp_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

PT-2026-8146

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the Bluetooth MGMT subsystem, specifically within the set ssp complete function. The issue arises from missing calls to mgmt pending free in both success and erro...

WordPress Plugin SSP Debug Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress plugin SSP Debug, which stems from...

CVE-2025-13494

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...

CVE-2025-13494

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...

CVE-2025-13494 SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...