CVE-2023-23397-PoC

CVE-2023-23397-PoC C send only version of CVE-2023-23397-POC-Powershell by Oddvar Moe @oddvarmoe Sends email from the address associated with Outlook account. .\CVE202323397.exe --help CVE202323397 1.0.0.0 Copyright c 2023 -t, --to Required. Recipient email address -p, --path Required. UNC Path -...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2025-33053-Checker-PoC

CVE-2025-33053 Vulnerability Checker & Proof-of-Concept PoC Checker Proof PoC Proof A complete set of tools to check and demonstrate potential exploitation of CVE-2025-33053 , a critical WebDAV-based Remote Code Execution RCE vulnerability affecting Windows systems. 📌 About CVE-2025-33053...

CVE-2026-22444

CVE-2026-22444 Apache Solr UNC Path Validation Vulnerability Overview CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation CWE-20: Improper Input Validation on certain API parameter...

CVE-2022-26809

CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

UnCanny

UNCanny Coerce The idea behind this research was simple as i wanted to find my own coercion technique. i started by looking for new RPC attack surfaces, but after microsoft added RPC activity monitoring...

windows-coerced-authentication-methods

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...

cve-2025-24071

CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. ⚠️ This is for educational and research purposes only. Do not use this on production...

cve-2024-43451-ntlm_hash_disclosure_reproduction

CVE-2024-43451 — Windows NTLM Hash Disclosure Spoofing Vulnerability Overview CVE-2024-43451 is an NTLMv2 hash disclosure spoofing vulnerability in Windows. It allows an unauthenticated remote attacker to leak a victim's NTLM hash by convincing them to interact with a malicious .url shortcut file...

CVE-2021-1675

Explanation of the vulnerability The Printer Spooler is a Windows service that manages print queues. It receives jobs submitted by the user, converts them to a format the printer understands, and sends them when the printer is available. It runs as a system service spoolsv.exe with high privilege...

CVE-2023-23397

A Simple PoC in PowerShell for CVE-2023-23397 CVE-2023-23397 is a vulnerability in MS Outlook that allows an attacker to potentially exfil user authentication details. The vulnerability relates to the the ability for an attacker to specify a UNC path in the "ReminderSoundFile" property within an...

CVE-2026-32202

Disclaimer This tool is for authorized red teaming and penetration testing only. Unauthorized use against systems without explicit permission is illegal. Use at your own risk. The author assumes no liability for any misuse or damage. Description NTLMv2 hash coercion via incomplete Windows Shell...

CVE-2020-13941

CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr Multiple Solr endpoints have been found to accept absolute paths. In Windows systems these absolute path can be forced to make the OS connect to an attacker-controlled SMB server. This behaviour may result in attacks such as...

CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient

CVE-2024-40586 Windows Coerced Authentication in FortiClient On Windows system, it was found that FortiClient App version 7.0.8.0427 allow a remote unprivileged user to coerce Windows hosts authenticate to other machines via a named pipe responsible for FortiSSLVPNdaemon service. It was observed...

SMBRat

SMBRat A Windows Remote Administration Tool in Visual Basic Script Idea Windows Environments like Active Directory Networks, get really bloated with SMB traffic. All hosts get Policies from the SYSVOL , configurations need remote files to work, desktop shortcuts tend to point to...

OutlookNTLM_CVE-2023-23397

To exploit this vulnerability, an attacker must create a malicious calendar invitation that includes a reference to a sound file pointing to a file in a network share in the attacker's machine. At a low level, an Outlook email stores the reference to the sound file in an internal parameter called...

CVE-2023-23397

CVE-2023-23397 Vulnerability Details 🚨💻 Microsoft has recently addressed a set of critical security vulnerabilities, including this zero-day exploits: CVE-2023-23397. The Common Vulnerability Scoring System CVSS assigned score of 9.8 to this exploit. CVE-2023-23397: Elevation of Privilege in...

CVE-2023-23397

CVE-2023-23397 CVE-2023-23397 C PoC 1- download the msgkit 2- edit the appointment class and add the below: 3- create a new class inside the project to set the proprieties of the msg file: using MsgKit.Enums; using System; using System.Collections.Generic; using System.Linq; using System.Text;...