PowerHuntShares

PowerHuntShares v2 PowerHuntShares is PowerShell tool designed to help cybersecurity teams and penetration testers better identify, understand, attack, and remediate SMB shares in the Active Directory environments they protect. Every hacker has a story about abusing SMB shares, but it’s an attack...

ldap_shell

LDAP shell This project is a fork of ldapshell from Impacket. It provides an interactive shell for Active Directory enumeration and manipulation via LDAP/LDAPS protocols, making it useful for both system administrators and security professionals. Installation These tools are only compatible with...

s3tk

s3tk A security toolkit for Amazon S3 🍊 Battle-tested at Instacart Installation Run: root@kitploit: pip install s3tk You can use the AWS CLI or AWS Vault to set up your AWS credentials: root@kitploit: pip install awscli aws configure See IAM policies needed for each command. Commands Scan Scan yo...

CVE-2024-54679

CVE-2024-54679 CVE-2024-54679 - CyberPanel aka Cyber Panel Denial of Service Description A denial of service DoS vulnerability was discovered in Cyber Panel that allows any authenticated user to restart the database by sending requests to the /dataBases/restartMySQL endpoint. This vulnerability...

LAPSToolkit

LAPSToolkit Functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution LAPS. It includes finding groups specifically delegated by sysadmins, finding users with "All Extended Rights"...

Adalanche

Adalanche Open Source Attack Graph Visualizer and Explorer Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and...

CVE-2024-38473-Nuclei-Template

CVE-2024-38473 Nuclei Template Description Nuclei template designed to detect Apache servers vulnerable to CVE-2024-38473. It first identifies servers running Apache 2.4.60 with default PHP-FPM settings. Then, it fuzzes for potential PHP files protected by ACLs that might be bypassed due to this...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

aclpwn.py

aclpwn.py Aclpwn.py 是一个与 BloodHound 交互的工具，用于识别和利用基于 ACL 的权限提升路径。它接受起始点和目标点，并使用 Neo4j 路径查找算法来找到最高效的基于 ACL 的权限提升路径。Aclpwn.py 类似于基于 PowerShell 的 Invoke-Aclpwn，您可以在我们的博客中了解更多信息。 依赖项与安装 Aclpwn.py 兼容 Python 2.7 和 3.5 以上版本。它需要 neo4j-driver、impacket 和 ldap3 库。您可以通过 pip 安装 aclpwn.py：pip install aclpwn。对于...

cve-2022-33891-fix

EP3 - MAC0352 Redes deComputadores e Sistemas Distribuidos 2023 Tópico: CVE-2022-33891 Execução de comandos shell arbitrários em aplicação spark que utiliza autenticação via ACL Alunos Elinilson Vital Leoarndo Bozzetto CVE-2022-33891 Patch Instructions for Ubuntu 22.04 Prerequisites Ubuntu 22.04...

Apache HTTP Server - ACL Bypass

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. id: CVE-2024-38473 info: name: Apache HTTP Server - ACL Bypass author: pdteam severity: high...

S3BucketList

S3BucketList Search, lists, and checks S3 Buckets found in network requests while you are browsing. Features Filters S3Buckets Extract ACL permissions Download recorded buckets Manage recorded buckets Tab-specific bucket recording Detect unclaimed / hanging / vulnerable buckets Installation Chrom...

casbin

Apache Casbin Noticias : ¿aún te preocupa cómo escribir la política correcta de Apache Casbin? ¡Apache Casbin online editor viene a ayudarte! Pruébalo en: https://casbin.apache.org/editor/ Apache Casbin es una biblioteca de control de acceso de código abierto, potente y eficiente, para proyectos...

BypassFuzzer

Bypass Fuzzer The original 403fuzzer.py : ==Note: This has been deprecated for my new, shiny burp extension that is 1000000% better. Thank you for using my tools!== You can find the extension here: https://github.com/intrudir/BypassFuzzer-Burp Fuzz 401/403ing endpoints for bypasses Perform variou...

ACLight

ACLight A tool for advanced discovery of Privileged Accounts - including Shadow Admins. ACLight2 is the improved version of the tool. Shadow Admins Research The tool version 1 was published as part of the "Shadow Admins" research - more details on "Shadow Admins" are in the blog post:...

r77-rootkit

r77 Rootkit 无文件 ring 3 Rootkit r77 是一个 ring 3 的 Rootkit，可以隐藏一切： 文件、目录 进程及 CPU/GPU 使用率 注册表键和值 服务 TCP 和 UDP 连接 交接点、命名管道、计划任务 通过前缀隐藏 所有以 "$77" 开头的内容都会被隐藏。 配置系统 动态配置系统允许根据 PID 和 名称 隐藏进程，根据 完整路径 隐藏文件系统项，隐藏特定端口的 TCP 和 UDP 连接等。 配置位于 HKEYLOCALMACHINE\SOFTWARE$77config，任何进程无需提升权限即可写入。该键的 DACL...

mud-visualizer

制造商使用描述（MUD）可视化工具 警告：mud-visualizer 目前处于测试阶段，使用风险自负。 该工具可用于可视化 JSON 格式的 MUD 文件。 目录 动机 安装 支持的 MUD 抽象 贡献 支持 引用 许可证 动机 MUD 文件是包含设备 ACL 规则的 JSON 格式纯文本文件。一个 MUD 文件可能包含数十或数百条 ACL 规则，这使得手动阅读和验证文件变得困难。mud-visualizer 将帮助您阅读、验证（并在不久的将来修改）MUD 文件。 安装 使用以下命令安装并运行 mud-visualizer： root@kitploit: $ git clone...

mud-visualizer

Manufacturer Usage Description MUD Visualizer Warning: mud-visualizer is currently beta. Use at your own risk. This tool can be used to visualize the MUD files in JSON format. Table of Contents Motivation Installation Supported MUD Abstractions Contribution Support Citation License Motivation MUD...

OUned

OUned El proyecto OUned, una herramienta de explotación que automatiza el abuso de las ACL de Unidades Organizativas mediante la manipulación de gPLink. Para una explicación detallada sobre el principio en el que se basa el ataque, la configuración necesaria y el uso de la herramienta, puede...

adwsdomaindump

ADWSDomainDump 通过ADWS（Active Directory Web Services）进行Active Directory信息转储。 安装 推荐安装方式： root@kitploit: pipx install git+https://github.com/mverschu/adwsdomaindump 或 pipx install . 使用 root@kitploit: adwsdomaindump -u 'corp.local\jsmith' -p 'password' -n 10.0.0.1 dc01.corp.local 正在连接ADWS主机... +...