RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

GIUDA

GIUDA GET a TGS on behalf of another user without password Scenario: you are Local Administrator and there is a logged User you want to Impersonate! Chain: SeTcbPrivilege allows you to read LSA storage, extract the SESSION KEY from TGT, and forge a request asking for a TGS; You must use LUID...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/\ Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name to specify a...

mitm6

mitm6 mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, providing victims with a link-local IPv6 address and setting the attackers host as default DNS server. As DNS server, mitm6 will...

CVE-2024-3183-POC

CVE-2024-3183-POC POC for CVE-2024-3183 FreeIPA Rosting Impact: A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force kerberoasting. Patch impacket-getTGT: 1. Add decoder.decode.defaultErrorState = stGetValueDecoderByTag to...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CLEANSTART-2024-NJ43669 null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request)

Security vulnerability affects the heimdal package. A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request...

Rocky Linux 9 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc Multiple Vulnerabilities (crlsa-2023_6699)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236699 advisory. krb5: Denial of service through freeing uninitialized pointer CVE-2023-36054 krb5: double-free in KDC TGS processing CVE-2023-39975 Tenable has extracted t...

AlmaLinux 9.2 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-epn / ipa-client-samba / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763391572)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763391572 advisory. - A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

SUSE CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

DEBIAN-CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...