ActiveDirectoryEnumeration

ADE - ActiveDirectoryEnum python -m ade usage: ade -h --dc DC -o OUTFILE -u USER -s -smb -kp -bh -spn -sysvol --all --no-creds --dry-run --exploit EXPLOIT / | / / / \ / / / / / /| |/ / / / | / / / / / / / / / / / / / / / / / / / / / / \ / / // // /| |/ / / // / / / / / // /...

ADCollector

ADCollector ADCollector is a lightweight tool that enumerates the Active Directory environment to identify possible attack vectors. It will give you a basic understanding of the configuration/deployment of the environment as a starting point. Notes: ADCollector is not an alternative to the powerf...

GPOHound

GPOHound GPOHound is a tool for dumping and analysing Group Policy Objects GPOs extracted from the SYSVOL share. It provides a structured, formalized format to help uncover misconfigurations, insecure settings, and privilege escalation paths in Active Directory environments. The tool integrates...

Group3r

by Mike Loss @mikeloss with help from @LukeHealy, @Sh3r4, and @LegendOfLynkle Development of Group3r was generously supported by my previous employer: OK BUT WTF IS IT DO? Like its ancestors, Group3r is a tool for pentesters and red teamers to rapidly enumerate relevant settings in AD Group Polic...

GPOHound — Updated!

GPOHound GPOHound is a tool for dumping and analysing Group Policy Objects GPOs extracted from the SYSVOL share. It provides a structured, formalized format to help uncover misconfigurations, insecure settings, and privilege escalation paths in Active Directory environments. The tool integrates...

GPP Password Hunter

Search SYSVOL Group Policy Preferences XML files for encrypted cpassword credentials via SMB. !/usr/bin/env python3 -- coding: utf-8 -- """Hunt Group Policy Preferences passwords on SMB SYSVOL.""" from future import annotations import json import os import tempfile from typing import Dict, List...

GPO Registry Audit

Parse SYSVOL GPO registry settings Registry.xml, registry.pol and detect relay-friendly SMB/NTLM policies, autologon passwords, and stored credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Audit insecure registry settings configured via GPO on SYSVOL.""" from future import annotations...

GPO Privilege Rights Audit

Parse SYSVOL GptTmpl.inf User Rights Assignment and detect trustees with dangerous privileges SeDebug, SeImpersonate, SeBackup, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Audit dangerous User Rights Assignment configured via GPO on SYSVOL.""" from future import annotations import json fro...

GPO Local Group Audit

Parse SYSVOL GPO files Groups.xml, GptTmpl.inf and detect trustees added to privileged local groups Administrators, RDP Users, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Audit privileged local group assignments configured via GPO on SYSVOL.""" from future import annotations import json fr...

Windows Get GPP Autologon

Search SYSVOL Registry.xml files for Group Policy Preferences autologon credentials on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re...

EUVD-2002-0441

Malware in sbrugna...

EUVD-2024-17335

Malicious code in bioql PyPI...

CVE-2024-1591

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues...

CVE-2024-1591

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues...

CVE-2024-1591

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues...

Design/Logic Flaw

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues...

CVE-2024-1591

The CVE-2024-1591 issue affects BeyondTrust’s Privilege Management for Windows (prior to version 24.1). A local authenticated attacker can view Sysvol when the product is configured to use a GPO policy, enabling potential discovery of configuration issues and policy details. The connected PT-2024...

PT-2024-18155 · Beyondtrust · Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: Privilege Management for Windows versions prior to 24.1 Description: A local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy, allowing them to view the policy and potentially find...

CVE-2024-1591: Exposure of Sensitive Information to an Unauthorized Actor

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues...

BeyondTrust Privilege Management Security Vulnerability

BeyondTrust Privilege Management is the BeyondTrust Privilege Management tool for Windows and Mac SaaS from BeyondTrust USA. A security vulnerability exists in BeyondTrust Privilege Management for Windows versions prior to 24.1. An attacker could exploit the vulnerability to view Sysvol...