CVE-2024-3183-POC

CVE-2024-3183-POC POC para CVE-2024-3183 FreeIPA Rosting Impacto: Un usuario con pocos privilegios puede obtener un hash de las contraseñas de todos los usuarios del dominio y realizar fuerza bruta offline kerberoasting. Parche para impacket-getTGT: 1. Añade decoder.decode.defaultErrorState =...

MITM6-Kerberos-CNAME-Abuse

Kerberos 认证中继 - CNAME 滥用技术（PoC） 背景 该工具是基于 MITM6 工具的 Kerberos CNAME 滥用中继技术的概念验证。 研究发现 Windows Kerberos 客户端行为存在一个缺陷：当返回 DNS CNAME 记录时，客户端会跟随别名，并使用 CNAME 主机名作为 SPN 构建 TGS 请求。这使得处于 DNS MITM 位置的攻击者能够强制任何域用户为攻击者选择的服务请求 Kerberos 票据，从而能够对 SMB、HTTP 和其他未强制执行签名或通道绑定的服务进行按需、跨协议的中继攻击。 与以往仅限于机器账户或需要特定条件的...

RiskySPN

RiskySPNs RiskySPNs 是一个专注于检测和滥用与 SPN（服务主体名称）关联的帐户的 PowerShell 脚本集合。该模块可帮助蓝队识别潜在危险的 SPN，同时也能帮助红队通过利用 Kerberos 和 Active Directory 来提升权限。 详细信息请参阅：http://www.cyberark.com/blog/service-accounts-weakest-link-chain/ 用法 安装模块 Import-Module .\RiskySPNs.psm1 或者直接加载脚本（你也可以从网页IEX 加载）...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/ Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name to specify a...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

GIUDA

GIUDA Obtén un TGS en nombre de otro usuario sin contraseña Escenario: eres administrador local y hay un usuario con sesión iniciada al que quieres suplantar! Cadena: SeTcbPrivilege te permite leer el almacenamiento LSA, extraer la CLAVE DE SESIÓN del TGT y forjar una solicitud pidiendo un TGS;...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

SUSE CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

DEBIAN-CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

EUVD-2026-63245

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

In FreeIPA, when a trust relationship with Active Directory is configured, services fail to verify the Privilege Attribute Certificate (PAC) in Kerberos TGS tickets, allowing an authenticated AD user to impersonate a client name and bypass authentication for the portal, SMB server, and LDAP direc...

CVE-2026-11861 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

PT-2026-78915

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

Linux Distros Unpatched Vulnerability : CVE-2026-11861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for...