Lucene search
+L

11 matches found

Kitploit
Kitploit
added 2026/09/15 3:27 p.m.11 views

pywhisker

pyWhisker pyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C. This tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on a Python equivalent o...

6.1AI score
SaveExploits0References16
Kitploit
Kitploit
added 2026/09/15 3:05 p.m.11 views

KrbRelay

KrbRelay Relaying 3-headed dogs. More details at https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html and https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html This should be working on most fully patched Windows systems...

6AI score
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/15 8:57 a.m.8 views

Whisker

Whisker Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 12:59 a.m.10 views

ShadowSpray

ShadowSpray A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or...

6AI score
SaveExploits0References10
Kitploit
Kitploit
added 2026/09/13 5:23 p.m.8 views

KrbRelayUp

KrbRelayUp Rubeus と KrbRelay の機能の一部(および謝辞セクションにあるその他の honorable mentions)をラップしたシンプルなツールで、以下の攻撃プリミティブの悪用を効率化します。 0. (任意)新しいマシンアカウントの作成(New-MachineAccount) 1. ローカルマシンアカウントの認証強制(KrbRelay) 2. LDAP への Kerberos リレー(KrbRelay) 3. RBCD 権限を追加し、ローカルマシンへの特権 ST を取得(Rubeus) 4. その ST を使用してローカルの Service Manager...

6AI score
SaveExploits0References16
Metasploit
Metasploit
added 2026/06/17 7:03 p.m.288 views

NTLM Relay to Self (HTTP to LDAP) - Post Exploitation

This module performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server on the compromised host, then triggers the WebClient service via an ETW event allowing a low-privilege user to start it, and coerces the local machine account to authenticate via...

6AI score
SaveExploits0
Metasploit
Metasploit
added 2025/07/31 6:56 p.m.599 views

Exploits AD CS Template misconfigurations which involve updating an LDAP object: ESC9, ESC10, and ESC16

This module exploits Active Directory Certificate Services AD CS template misconfigurations, specifically ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user. The module leverages the auxiliary/admin/ldap/ldapobjectattribute module to update...

6AI score
SaveExploits0
Rapid7 Blog
Rapid7 Blog
added 2024/05/17 8:11 p.m.25 views

Metasploit Wrap-Up 05/17/2024

LDAP Authentication Improvements This week, in Metasploit v6.4.9, the team has added multiple improvements for LDAP related attacks. Two improvements relating to authentication is the new support for Signing and Channel Binding. Microsoft has been making changes to harden the communications to...

7.5AI score
SaveExploits0
Rapid7 Blog
Rapid7 Blog
added 2024/04/12 5:47 p.m.38 views

Metasploit Weekly Wrap-Up 04/12/24

Account Takeover using Shadow Credentials The new release of Metasploit Framework includes a Shadow Credentials module added by smashery used for reliably taking over an Active Directory user account or computer, and letting future authentication to happen as that account. This can be chained wit...

7.8AI score0.5132EPSS
SaveExploits8
Kitploit
Kitploit
added 2023/05/15 12:30 p.m.25 views

ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

8AI score
SaveExploits0References10
Kitploit
Kitploit
added 2021/07/13 9:30 p.m.72 views

Whisker - A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute

Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this attack to...

7.6AI score
SaveExploits0References2
Rows per page
Query Builder