kerbrute

kerbrute Impacket 라이브러리를 사용하여 kerberos 브루트포싱을 수행하는 스크립트입니다. 실행 시, 입력으로 사용자 또는 사용자 목록과 비밀번호 또는 비밀번호 목록을 받습니다. 그런 다음 다음과 같은 항목을 열거하기 위해 브루트포스 공격을 수행합니다: 유효한 사용자/비밀번호 쌍 유효한 사용자 이름 사전 인증이 필요하지 않은 사용자 결과적으로, 스크립트는 발견된 유효한 자격 증명 목록과 해당 자격 증명으로 생성된 TGT를 생성합니다. 설치 pypi에서: pip3 install kerbrute 저장소에서: git...

pre2k

/'\ /\ \ /\ /\ \ \ /'\ /\ '/'/'\ //// /\ \ , \ \ \L\ \ \ //\ //\ // /\ \ \ \\ \ \ ,/\ \\ \// // \ \ \ \ \ / // // // //// \ \ v3.0 // @unsignedsh0rt @Tw1sm Pre2k Pre2k は、対象ドメインへの足場を築くために悪用される可能性がある pre-Windows 2000 コンピュータオブジェクトの存在を問い合わせるツールです。@Oddvarmoe によって発見されました。Pre2k...

harpyTools

Active Directory 사후 침투 및 릴레이 자동화 유틸리티 이 저장소는 Active Directory 환경 내에서 보안 평가 및 침투 테스트를 위해 설계된 Python 오케스트레이터 스크립트 모음입니다. 이 도구는 손상된 워크스테이션 또는 서버에서 이미 로컬 관리자 접근 권한이 확보된 사후 침투 시나리오에 특화되어 있으며, 목표는 광범위한 Active Directory 도메인으로의 측면 이동 또는 권한 상승을 수행하는 것입니다. NetExec, Impacket, Donut, BloodyAD와 같은 일반적인 보안 유틸리...

tgt-monitor-bof

Kerberos TGT 監視 & 自動更新 このリポジトリには、2つの非同期ビーコンオブジェクトファイル（BOF）が含まれています。1つ目は tgt-monitor で、Kerberos ログオンイベントを監視し、新しい Kerberos TGT がキャプチャされるたびにエージェントを起動します。Rubeus の monitor コマンドと同様に、この BOF は無期限に実行され、定期的にシステム上の LSA チケットキャッシュをチェックします。新しい TGT が検出されると、チケットのメタデータを表示し、pass-the-ticket 攻撃による横方向の移動に使用できる base64...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/ Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name to specify a...

PKINITtools

PKINIT 도구 이 저장소에는 PKINIT 및 인증서를 다루기 위한 몇 가지 유틸리티가 포함되어 있습니다. 도구는 minikerberos와 impacket을 기반으로 제작되었습니다. 더 많은 맥락을 제공하는 블로그 게시물: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ 설치 이 도구들은 Python 3.5+에서만 호환됩니다. GitHub에서 저장소를 클론하고, 종속성을 설치하면 바로 사용할 수 있습니다: git clone...

CVE-2024-20674

CVE-2024-20674 これは、公開済みCVEであるCVE-2024-20674のエクスプロイトに対する私の見解です。Kerberos U2U TGT-REPのクライアント側処理におけるロジックバグを利用して、Kerberos相互認証のバイパスを達成します。 これは、例えば、クライアントに対してDCを偽装する際に任意のGPOを配信し、マシンを制御するために使用できます。 前提条件 : ネットワーク上で中間者攻撃が可能であること、認証不要であること。 本論文におけるエクスプロイトの解説...

CVE-2026-104034 Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager KCM responder during Kerberos ticket-granting ticket TGT renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos tick...

CVE-2026-26128

CVE-2026-26128 Windows Active Directory における Unicode 正規化を介した Kerberos リフレクションを悪用する Python ツール。Guillaume André / Synacktiv による研究に基づいています。 インストール これらのツールは Python 3.8+ とのみ互換性があります。GitHub からリポジトリをクローンし、依存関係をインストールすればすぐに使用できます: git clone https://github.com/jarnovandenbrink/CVE-2026-26128.git cd...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fixed a possible Use-after-Allocation UAF in snictgtcreate A warning is reported as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warning: &‘tgt-list’ was not removed from the list If the deviceadd function...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

CVE-2026-15243: Improper Validation of Certificate with Host Mismatch

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS : tgt vulnerability (USN-8325-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8325-1 advisory. It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could...

USN-8325-1 tgt vulnerability

It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could possibly use this issue to make tgt generate an identical sequence of challenges, resulting in authentication bypass...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: mpi3mr: Issues in mpi3mrgetalltgtinfo have been fixed. The function mpi3mrgetalltgtinfo has four issues: 1. It calculates the valid entry length in alltgtinfo assuming that the header part of the struct mpi3mrdevicemapin...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013553 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows:...

GHSA-JF89-3Q6Q-VCGR Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the TGT credential field via the Nimbus Thrift API, due to deserialization of base64-encoded data using ObjectInputStream.readObject without class filtering or validation. A user with topology...

Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...