ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM 泄露 新漏洞允许通过一次点击从浏览器泄露NTLM哈希 作者：Ruben Enkaoua 描述 Microsoft ms-photos URI 方案将 fileName 作为参数，该参数可以提交带有 UNC 路径，在打开时泄露 NTLMv2-SSP 哈希。通过构造一个特殊格式的链接，攻击者可以强迫受害者直接从浏览器启动 Microsoft Photos 应用。当触发时，此行为会导致受害者的 NTLMv2-SSP...

DragonCastle

DragonCastle 一个概念验证（PoC），将 AutodialDLL 横向移动技术与 SSP 相结合，从 LSASS 进程中提取 NTLM 哈希。 描述 将 DLL 上传到目标机器。然后启用远程注册表以修改 AutodialDLL 条目，并启动/重启 BITS 服务。Svchost 进程将加载我们提供的 DLL，将 AutodialDLL 重新设置为默认值，并通过 RPC 请求强制 LSASS 将同一个 DLL 作为安全支持提供程序（SSP）加载。 一旦 LSASS 加载了该 DLL，它会在进程内存中搜索，提取 NTLM 哈希以及密钥/IV。 DLLMain 始终返回...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

用于绕过 NX PIE SSP ASLR 这个PoC不稳定。 有时HTTP服务会宕机。 你应该修复morecore-offset并选择正确的libc-file。...

CVE-2025-24054

Windows 文件资源管理器零点击 NTLMv2-SSP 哈希泄露 🎥 演示 POC + 2025年3月补丁绕过 🎥 补丁绕过 点击上方图片观看漏洞演示 📋 技术概述 本仓库提供了一个全面的研究框架，分析了 Windows Shell 文件格式处理中导致 NTLMv2-SSP 凭据泄露的漏洞链。该工具包实现了两种不同的攻击向量，利用 Windows 资源管理器在文件预览操作期间自动解析 UNC 路径的特性。 核心漏洞机制 根本安全问题在于 Windows Shell 在预览操作期间自动处理特定文件格式中嵌入的 UNC 路径。当用户打开包含特制文件的 ZIP 存档时，Windows...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor 脚本 一个全面的 Cobalt Strike Aggressor 脚本，用于武器化并执行恶意 LNK 文件和 Library-MS 文件，以泄露 SMB NTLMv2-SSP 哈希。包含 CVE-2025-24054 绕过技术。 ⚠️ 免责声明 此工具仅用于教育和研究目的。作者对任何滥用此代码的行为不承担任何责任。仅在你拥有或明确获准测试的系统上使用。 捕获 NTLM 哈希 该脚本生成武器化的 .lnk 和 .library-ms 文件，当打开时会触发向操作者主机的 SMB 身份验证。 泄露的 NTLMv2...

CVE-2024-38063

CVE-2024-38063 - SSP H3 对于这个设置（来自视频的那个），我使用了 Windows 22H2 19045 和 build 2468。（这个 CVE 直到 4780 才被修补） 我在 Qemu/KVM 上尝试过，但网卡没有合并数据包（根据我用 tcpdump 调查的结果）。解决方案是使用 VirtualBox 的 Host-Only 网络。 我尝试了几个 PoC（巧干而非蛮干）： https://github.com/ThemeHackers/CVE-2024-38063...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

RHEL 8 : kernel (RHSA-2026:65709)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65709 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcievent: fix...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a memory leak in setsspcomplete. The memory leak was fixed in setsspcomplete, where the mgmtpendingcmd structures are not freed after they are removed from the pending list. Commit 302a1f674c00 “Bluetoot...

CVE-2026-46056

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...

CVE-2026-46056

The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: A memory leak occurs when the build ntlmssp negotiate blob operation fails. There is a memory leak when mounting CIFS shares: - Unreferenced object: 0xffff888166059600 size 448 Command: “mount.cifs”, PID: 51391, Jiffies:...

SUSE CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

UBUNTU-CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...