CVE-2025-21293

CVE-2025-21293 CVE-2025-21293 是 Active Directory 域服务中的一个权限提升漏洞。它允许"网络配置操作员"通过 Windows 性能计数器以 SYSTEM 权限执行代码。受影响的 Windows 版本包括 Windows 10、11 和 Server。Microsoft 已于 2025 年 1 月修补了此漏洞。请应用更新以降低风险。...

acltoolkit

acltoolkit acltoolkit 是一款 ACL 滥用瑞士军刀。它实现了多种 ACL 滥用功能。 目录 acltoolkit 目录 安装 用法 命令 get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript 安装 root@kitploit: pip install acltoolkit-ad 或 root@kitploit: git clone https://github.com/zblurx/acltoolkit.git cd acltoolkit...

PurpleSharp

PurpleSharp Defending enterprise networks against attackers continues to present a difficult challenge for blue teams. Prevention has fallen short; improving detection & response capabilities has proven to be a step in the right direction. However, without the telemetry produced by adversary...

adaudit

adaudit 此 PowerShell 脚本旨在对 Microsoft Active Directory 执行全面审计，重点识别常见安全漏洞与弱点。执行该脚本有助于精准定位需要加固的关键区域，从而抵御针对 Active Directory 的横向移动或权限提升攻击中常用的攻击手法。 root@kitploit: | | \ | | | || | | | | | | | | | . | | | |||/ ||||||| by phillips321 如果您有任何适用于此脚本的实用 PowerShell 单行命令，请告知我。我希望此脚本保持为单一文件，且不依赖外部工具（ntdsutil 和...

BadBlood

BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an...

BadBlood

BadBlood BadBlood 由 Secframe 提供，用于填充 Microsoft Active Directory 域的结构和数千个对象。该工具的输出是一个类似于真实世界域的域。在域上运行 BadBlood 后，安全分析师和工程师可以练习使用工具来理解并制定保护 Active Directory 的策略。每次运行此工具，它都会产生不同的结果。域、用户、组、计算机和权限都不同。每一次都不同。 完整用户指南和相关信息 命令 无：目前，脚本的所有项目都在 .ps1 文件中配置。文件在 Secframe.com 上的用户指南中有详细说明。 致谢...

krbrelayx

Krbrelayx - Kit de herramientas de retransmisión Kerberos y abuso de delegación no restringida Kit de herramientas para abusar de Kerberos. Requiere impacket, ldap3 y dnspython para funcionar. Se recomienda instalar impacket directamente desde git para tener la última versión disponible. Más...

monkey365

...

lil-pwny

Lil Pwny Fast offline auditing of Active Directory passwords using Python. About Lil Pwny Lil Pwny is a Python application to perform an offline audit of NTLM hashes of users' passwords, recovered from Active Directory, against known compromised passwords from Have I Been Pwned. Results will be...

Set-AuditRule

Set-AuditRule A repository of useful access control entries ACE that could be added to the system access control list SACL of a securable object's security descriptor to monitor potential adversarial activity. These entries are categorized by specific securable objects such as files, registry key...

Spray

Spray A Password Spraying tool for Active Directory Credentials by Jacob WilkinGreenwolf Getting Started These instructions will show you the requirements for and how to use Spray. Prerequisites All requirements come preinstalled on Kali Linux, to run on other flavors or Mac just make sure curlow...

GOAD

GOAD v3 🔖 Documentación : https://orange-cyberdefense.github.io/GOAD/ Descripción GOAD es un proyecto de laboratorio de Active Directory para pentesting. El propósito de este laboratorio es ofrecer a los pentesters un entorno de Active Directory vulnerable y listo para usar para practicar técnica...

rbcd-attack

滥用 Kerberos 基于资源的约束性委派 TL;DR 本仓库介绍针对 Windows Active Directory 域中 Kerberos 基于资源的约束性委派的实际攻击方法。 与其他常见实现的不同之处在于，我们是从 Windows 域外部 发起攻击，而非从已加入域的（通常是 Windows）计算机。 该攻击仅使用 Python3Impacket（及其依赖）实现。已在 Arch 系统上使用最新版 Impacket（编写时版本为 0.9.21）测试通过。 攻击概述 简而言之，不涉及深层细节，该攻击针对域计算机，确切地说是针对目标域计算机的服务主体。 我们需要以下前提条件：...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

Exploit-CVE-2024-9513-NetAdmin-IAM-Allows-User-Enumeration-In-Active-Directory

Exploit 标题: CVE-2024-9513 - NetAdmin IAM 允许 Active Directory 用户枚举 日期: 2024-10-04 Exploit 作者: Elizeu Das Dores ELIZEUOPAIN 厂商主页: https://netadmin.software/ 版本: 3.5 测试于: 20224-10-05 CVE : CVE-2024-9513 参考文献:...

PT-ToolKit

PT-ToolKit 渗透测试或红队演练期间有用的漏洞利用程序、PowerShell脚本和可执行文件 大多数工具和脚本针对Active Directory环境和Windows平台 目录 漏洞利用程序 PowerShell脚本 Windows可执行文件 漏洞利用程序： 一些针对CVE的漏洞利用程序，我在GitHub上找到并编译了它们 所有漏洞利用程序都有源代码和描述 PowerShell脚本： 我在网上找到的脚本，大部分来自GitHub，有些是我自己编写的 它们在渗透测试或红队演练中非常有用，请明智使用 脚本针对Windows/域环境 Windows可执行文件...

Compromised-Org-Chart-Generator

Compromised Org Chart Generator Overview Active Directory is used by organization as the identity provider. It contains information of all employees including their names, job titles, departments, and their managers. Password audits can help to discover weaknesses and risks. You might try passwor...

CVE-2020-0665

CVE-2020-0665 - Bypass de Filtro SID Prueba de Concepto para CVE-2020-0665, que permite eludir el Filtrado SID en Bosques de Active Directory Ataque entre Bosques. Requisitos para el ataque La máquina Controladora de Dominio objetivo no debe tener parches posteriores a febrero de 2020. Haber...

youzer

youzer Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. root@kitploit: pip3 install faker You can either supply a wordlist or have t...

Grouper

Grouper DONT USE GROUPER ANY MORE. USE GROUPER2! https://github.com/l0ss/Grouper2 A PowerShell script for helping to find vulnerable settings in AD Group Policy. Photo by Jon Hanson - https://www.flickr.com/people/61952179@N00?rb=1 - https://creativecommons.org/licenses/by-sa/2.0/ Summary Grouper...