DarthSidious

Darth Sidious The goal is simple To share my modest knowledge about hacking Windows systems. This is commonly refered to as red team exercises. This book however, is also very concerned with the blue team; the defenders. That is, helping those who are working as defenders, analysts and security...

Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...

badsuccessor

BadSuccessor.py A penetration testing tool that exploits the dMSA delegated Managed Service Account privilege escalation vulnerability in Windows Server 2025 Active Directory environments. ⚠️ Legal Disclaimer This tool is for authorized penetration testing and security research purposes only. Use...

dcshadow

!WARNING DO NOT RUN IN PRODUCTION. This is meant for lab testing, for blue teams to work on identifying IoCs, event types, and behavior. Also, this tool is provided as-is. No support is planned apart from standard review on pull requests you may want to create. Don't run this from a Windows host...

AlmaLinux 9.2 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-epn / ipa-client-samba / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791544796)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791544796 advisory. - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users...

PT-2026-109328

Name of the Vulnerable Software and Affected Versions Trident versions v25.02.1 through v26.06.1 Description An authenticated attacker with access to debug logs can view sensitive information, including LUKS passphrases and SMB Active Directory credentials. Recommendations Update Trident to a...

OneLogicalMyth_Shell

OneLogicalMythShell This HTA shell was created to assist in breakout assessments. I built this over a year ago initally and thought others might find it useful so have now made it public. Please feel free to submit pull requests. Features File Explorer List Drives - Lists all local drives on the...

CVE-2026-106126

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

EUVD-2026-95207

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

CVE-2026-106126

A command injection vulnerability exists in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) . This flaw allows an authenticated, low-privileged attacker to execute arbitrary commands with SYSTEM privileges on the PDCe . The root cause is identified as CWE-78 (Improper Neu...

CVE-2026-106126 Command Injection

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

WinFlesher

Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷 WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex...

CVE-2026-41940

The recent CVE-2026-41940 vulnerability has raised great concern among server administrators using cPanel/WHM. It is a critical flaw that can allow authentication bypass, enabling unauthorized access to the administrative panel without valid credentials. Considering that WHM is the main control...

CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE

CVE-2026-20127-Cisco SD-WAN Pre-Authentication Remote Code Execution Overview This repository contains a proof-of-concept PoC exploit for CVE-2026-20127 , a critical pre-authentication remote code execution RCE vulnerability affecting Cisco Catalyst SD-WAN Controller formerly vSmart and Cisco...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...

cve-2026-20833-rc4-kerberos

CVE-2026-20833 — Kerberos RC4 Hardening This repository consolidates technical documentation , PowerShell scripts , Power BI dashboards , and official Microsoft references related to the progressive deprecation of RC4 in Kerberos for Active Directory environments , as part of Microsoft's security...

cve-2026-21509-mitigation

CVE-2026-21509 Mitigation Script Traditional Chinese version: READMEzh-TW.md Overview This script applies a registry-based mitigation to protect against CVE-2026-21509 Microsoft Office security feature bypass vulnerability, which has been exploited in the wild. CVE ID: CVE-2026-21509 Severity:...

Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data

Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data CVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Rated CVSS 5.5 Medium. Actively exploited and listed in CISA KEV; patch released January...

CVE-2026-33826

🚨 CVE-2026-33826: Windows Active Directory Remote Code Execution RCE 📌 General Overview CVE-2026-33826 is a critical Remote Code Execution RCE vulnerability affecting Active Directory Domain Services AD DS. The flaw resides in the way the AD service handles malformed authentication requests throu...

WSUS-RCE-Mitigation-59287

🚨 CRITICAL CYBERSECURITY ALERT: RCE in WSUS CVE-2025-59287 🚨 CREATOR AND CREDITS: @esteban11121 This guide has been created to help the community quickly mitigate the vulnerability. STATUS: Active Exploitation In-the-Wild Confirmed. This is a Remote Code Execution RCE vulnerability affecting WSUS...