tgt-monitor-bof

Kerberos TGT Monitoring & Auto-Renewal This repository contains two Async Beacon Object Files BOF. The first, tgt-monitor, monitors the system for Kerberos logon events and wakes up the agent whenever a new Kerberos TGT is captured. Similar to Rubeus' monitor command, this BOF is running...

harpyTools

Active Directory Post-Exploitation and Relay Automation Utilities This repository contains a collection of Python orchestrator scripts designed for security assessments and penetration testing within Active Directory environments. These tools are specifically engineered for post-exploitation...

pre2k

root@kitploit: /'\ /\ \ /\ /\ \ \ /'\ /\ '/'/'\ //// /\ \ , \ \ \L\ \ \ //\ //\ // /\ \ \ \\ \ \ ,/\ \\ \// // \ \ \ \ \ / // // // //// \ \ v3.0 // @unsignedsh0rt @Tw1sm Pre2k Pre2k is a tool to query for the existence of pre-windows 2000 computer objects which can be...

bifrost

Bifrost root@kitploit: \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/\ root@kitploit: Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for...

kerbrute

kerbrute An script to perform kerberos bruteforcing by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate: Valid username/passwords pairs Valid usernames Usernames withou...

CVE-2024-20674

CVE-2024-20674 This is my take at an exploit of the public CVE CVE-2024-20674 to achieve Kerberos mutual authentication bypass using a logic bug in the client-side handling of Kerberos U2U TGT-REP. This can be used for instance to serve arbitrary GPOs when spoofing the DC to a client, and take...

PKINITtools

Herramientas PKINIT Este repositorio contiene algunas utilidades para jugar con PKINIT y certificados. Las herramientas están construidas sobre minikerberos e impacket. Artículo de blog adjunto con más contexto: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ Instalación Estas...

CVE-2026-26128

CVE-2026-26128 Python tool to exploit Kerberos reflection via Unicode normalization in Windows Active Directory. Based on research by Guillaume André / Synacktiv. Installation These tools are only compatible with Python 3.8+. Clone the repository from GitHub, install the dependencies and you shou...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fixed a possible Use-after-Allocation UAF in snictgtcreate A warning is reported as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warning: &‘tgt-list’ was not removed from the list If the deviceadd function...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS : tgt vulnerability (USN-8325-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8325-1 advisory. It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could...

USN-8325-1 tgt vulnerability

It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could possibly use this issue to make tgt generate an identical sequence of challenges, resulting in authentication bypass...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: mpi3mr: Issues in mpi3mrgetalltgtinfo have been fixed. The function mpi3mrgetalltgtinfo has four issues: 1. It calculates the valid entry length in alltgtinfo assuming that the header part of the struct mpi3mrdevicemapin...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013553 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows:...

GHSA-JF89-3Q6Q-VCGR Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the TGT credential field via the Nimbus Thrift API, due to deserialization of base64-encoded data using ObjectInputStream.readObject without class filtering or validation. A user with topology...

Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2026-35337

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...