Coercer

Windows サーバーを自動的に強制し、さまざまな方法で任意のマシンに対して認証させる Python スクリプト。 Windows 対応 Windows 用バイナリをビルドするには、このリポジトリから installer.ps1 スクリプトをダウンロードします。引数なしで実行すると、作業ディレクトリにバイナリが作成されます。オプション付きのヘルプメニューを表示するには -h または --help を使用します。 機能 コア: リモートマシン上の開いている SMB パイプをリストアップ（scan 認証済みモードおよび fuzz 認証済みモード） 既知の SMB...

PetitPotam

PetitPotam WindowsホストにMS-EFSRPCのEfsRpcOpenFileRawなどの機能を介して他のマシンへの認証を強制するPoCツール : このツールは、より普及しているため、インタフェースc681d488-d850-11d0-8c52-00c04fd90f7eを持つLSARPC名前付きパイプを使用します。ただし、EFSRPC名前付きパイプとインタフェースdf1941c5-fe89-4e79-bf10-463657acf44dを使用してトリガーすることも可能です。ドメインコントローラに対して資格情報は必要ありません :D...

Astra Linux – Vulnerability in exim4

Exim NTLM Challenge Out-of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the handling of NTLM...

windows-coerced-authentication-methods

本仓库收录了多种强制 Windows 机器向攻击者控制的机器进行身份验证的方法。 所有这些方法都可以由域中的标准用户调用，以强制目标 Windows 机器（通常是域控制器）的机器账户向任意目标进行身份验证。这些方法中每个“漏洞/特性”的根本原因在于：Windows 机器在尝试访问 UNC 路径（如 \192.168.2.1\SYSVOL\file.txt）时，会自动向其他机器进行身份验证。 目前共有 15 个可用函数，涵盖 5 种协议。 !NOTE 🎉 还有许多新方法有待测试，如果你想尝试它们：possible-working-calls...

CVE-2026-73005

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

EUVD-2026-73767

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

Windows Authentication Methods Elevation of Privilege Vulnerability

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

CVE-2026-57288

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native ADSI authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a...

CVE-2026-56968

CVE-2026-56968 affects GNU SASL versions prior to 2.2.4. The NTLM client’s short challenge in the function _gsasl_ntlm_client_step has inadequate sanitization, which can lead to memory disclosure when interacting with a crafted server. Public sources (SUSE, Debian OSV, Ubuntu/Ubuntu-related advis...

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT default 10 hours and decrypt or forge any subsequent WS‑SecureConversation traffic that uses...

GHSA-WQP7-X3PW-XC5R Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...

EUVD-2026-36725

Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...

PT-2026-49575

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1 Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC Universal Naming Convention paths. On Windows systems, accessing a UNC path triggers an automatic NTLM...

CVE-2026-50508

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-50508 Windows NTLM Spoofing Vulnerability

...

CVE-2026-50508 Windows NTLM Spoofing Vulnerability

...

CVE-2026-50508

CVE-2026-50508 describes an exposure of sensitive information in Windows NTLM that enables an unauthenticated network-based spoofing capability. The vulnerability affects the Windows NTLM authentication path and is documented with a network attack vector and a high confidentiality impact. Public ...

Windows NTLM Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

PT-2026-48124

Name of the Vulnerable Software and Affected Versions Windows NTLM affected versions not specified Description Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an attacker to perform spoofing over a network, which can affect the system. Recommendations At the...

CVE-2026-8993

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...