Clean up stale Azure AD devices with script

Under normal circumstances, when powering off Azure Active Directory AAD joined non-persistent VM, MCS agent inside VM will perform Azure AD leave and remove device record from Azure Active Directory. Occasionally, the action may fail, it will leave stale device in Azure AD. Recently, Azure AD...

Privilege Escalation

samba is vulnerable to privilege escalation. Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption...

Samba Issues Security Updates to Patch Multiple High-Severity Vulnerabilities

Samba has released software updates to remediate multiple vulnerabilities that, if successfully exploited, could allow an attacker to take control of affected systems. The high-severity flaws, tracked as CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, and CVE-2022-45141, have been patched in...

CVE-2022-45141

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption...

CVE-2022-45141

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption...

Samba encryption vulnerabilities

Samba is the standard Windows interoperability program suite for Linux and Unix. A security vulnerability exists in samba versions prior to samba 4.15.13, samba versions prior to samba 4.16.8, which stems from the fact that a Samba AD DC using Heimdal can force the issuance of Kerberos tickets...

Samba AD DC using Heimdal can be forced to

Description Kerberos, the trusted third party authentication system at the heart of Active Directory, issues a ticket using a key known to the target server but nobody else, returned to the client in a TGS-REP. This key needs to be of a type understood only by the KDC and target server. However,...

rc4-hmac Kerberos session keys issued

Description Kerberos, the trusted third party authentication system at the heart of Active Directory, issues a session key known to the target server and the client, encrypted to both services in a TGS-REP. The key algorithm chosen for here is then used for the subsequent signed or encrypted...

Security fix for the ALT Linux 10 package samba version 4.16.8-alt1

Dec. 15, 2022 Evgeny Sinelnikov 4.16.8-alt1 - Update to maintenance release of Samba 4.16 with fixes of the Samba CVE for the Windows Kerberos Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022 CVE-2022-37967, CVE-2022-37966. - Security fixes: + CVE-2022-37966: A Samba Acti...

FarsightAD - PowerShell Script That Aim To Help Uncovering (Eventual) Persistence Mechanisms Deployed By A Threat Actor Following An Active Directory Domain Compromise

FarsightAD is a PowerShell script that aim to help uncovering eventual persistence mechanisms deployed by a threat actor following an Active Directory domain compromise. The script produces CSV / JSON file exports of various objects and their attributes, enriched with timestamps from replication...

Amazon Linux 2022 : samba (ALAS2022-2022-224)

The version of samba installed on the remote host is prior to 4.16.2-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-224 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the...

Active Directory Certificate Service Privilege Escalation

The vulnerability of the Active Directory Certificate service on Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

CVE-2022-45910

Improper neutralization of special elements used in an LDAP query 'LDAP Injection' vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries DoS, additional queries, filter manipulation during...

Active Directory Certificate Services Bypass

The vulnerability of the Active Directory Certificate Services component for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

PT-2022-27680 · Apache · Apache Manifoldcf

Name of the Vulnerable Software and Affected Versions: Apache ManifoldCF versions 2.23 and prior versions Description: The issue is related to improper neutralization of special elements used in an LDAP query, also known as 'LDAP Injection'. This allows an attacker to manipulate the LDAP search...

Apache ManifoldCF injection vulnerability

Apache ManifoldCF is an open source framework of the United States Apache Apache Foundation . It is used to connect a source content repository to a target repository or index. An injection vulnerability exists in Apache ManifoldCF version 2.23 and earlier, which stems from improper neutralizatio...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the DSInternals.Common.Data.RoamedCredential.Save method, which incorrectly parses the msPKIAccountCredentials LDAP attribute values. Consequently, a malicious actor would be able to modify the computer's file...

GHSA-VX2X-9CFF-FHJW DSInternals Credential Roaming Elevation of Privilege Vulnerability

Impact A vulnerability exists in the DSInternals.Common.Data.RoamedCredential.Save method, which incorrectly parses the msPKIAccountCredentials LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this functi...

Windows 11 VDA machines stuck at Initializing for Azure AD or Hybrid Azure AD

For Citrix MCS provisioned Azure AD or Hybrid Azure AD joined machine catalogs that use Windows 11 22H2 or 23H2 as master VMs’ OS, the VDA machines might be stuck at “Initializing” status after startup. And when you login to the VDA machines and execute the “dsregcmd /status” command, “Provider:...

Command Execution Vulnerability in ZOHO ManageEngine ADManager Plus

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...