RAITrigger

RAITrigger The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. It turns out, that this function can be called from any low privileged user not to spawn a process but to trigger SYSTEM authentication to an...

json-sanitizer

json-sanitizer Dado contenido similar a JSON, JSON Sanitizer lo convierte en JSON válido. Primeros pasos - Contacto Esto puede conectarse en cualquiera de los extremos de una tubería de datos para ayudar a satisfacer el principio de Postel: sé conservador en lo que haces, sé liberal en lo que...

PetitPotam

PetitPotam Herramienta PoC para forzar a hosts Windows a autenticarse en otras máquinas a través de MS-EFSRPC EfsRpcOpenFileRaw u otras funciones : Las herramientas utilizan la tubería con nombre LSARPC con la interfaz c681d488-d850-11d0-8c52-00c04fd90f7e porque es más prevalente. Pero es posible...

CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

SmallRye GraphQL contains a flaw in its number scalar coercion for BigInteger , which fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query containing a large exponent float literal, triggering the allocation of extremely l...

EUVD-2026-68525

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

ADCSPwn

ADCSPwn Una herramienta para escalar privilegios en una red de Active Directory mediante la coerción de autenticación de cuentas de máquina Petitpotam y la retransmisión al servicio de certificados. Uso Ejecuta ADCSPwn en tu red objetivo. root@kitploit: Author: @batsec - MDSec ActiveBreach...

Ivanti-EPM-Coercion-Vulnerabilities

Vulnerabilidades de Coerción de Ivanti EPM Exploits de prueba de concepto para Ivanti EPM CVE-2024-13159 y otros que permiten la coerción no autenticada de la credencial de la máquina Ivanti EPM para su uso en ataques de retransmisión. Publicación en el Blog Análisis en profundidad aquí:...

cupntlm-Automated-Exploit-For-CVE-2025-33073-

cupntlm CVE-2025-33073 — Bypass de reflexión NTLM mediante coerción DNS Herramienta de explotación automatizada para entornos de Active Directory. Descripción general cupntlm automatiza la cadena de ataque de reflexión/retransmisión NTLM que abusa de CVE-2025-33073. Combina la inyección de...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

windows-coerced-authentication-methods

Este repositorio contiene una lista de muchos métodos para forzar a una máquina Windows a autenticarse contra una máquina controlada por un atacante. Todos estos métodos pueden ser invocados por un usuario estándar del dominio para forzar a la cuenta de máquina del equipo Windows objetivo...

relay_bible

Relay Bible — Guida al Relay per Test di Penetrazione Interni Un riferimento completo per gli attacchi di relay NTLM durante test di penetrazione interni autorizzati. Copre i fondamenti dell'autenticazione, le tecniche di coercizione, i target di relay per protocollo, gli strumenti, il chaining...

CVE-2026-23751-poc

CVE-2026-23751-poc Prova de conceito que reimplementa a técnica descrita em Code White's NewRemotingTricks, direcionada ao Tungsten Automation Kofax Capture. CVE-2026-23751 Título: Tungsten Automation - Kofax Capture Leitura/Gravação de Arquivos Não Autenticada e Coerção SMB via .NET HTTP Remotin...

RemoteMonologue

RemoteMonologue RemoteMonologue é uma técnica de captura de credenciais no Windows que possibilita o comprometimento remoto de usuários ao explorar a chave RunAs do usuário interativo Interactive User e forçar autenticações NTLM via DCOM. Leia o RemoteMonologue: Weaponizing DCOM for NTLM...

CVE-2025-33073-checker

CVE-2025-33073 Script di Verifica Questo script di verifica PoC approssimativo testa i target per la vulnerabilità CVE-2025-33073 tentando di eseguire attacchi di riflessione NTLM utilizzando la coercizione dell'autenticazione NTLM tramite Samba RPC; per farlo è necessario avere un account con...

CVE-2025-33073

Strumento di Iniezione DNS Relay + Coercizione NTLM di Obscura$ Una proof-of-concept furtiva che combina iniezione DNS, relay NTLM e coercizione basata su RPC per testare i percorsi di relay di autenticazione in ambienti Active Directory Windows. ⚠️ DICHIARAZIONE DI NON RESPONSABILITÀ: Solo per...

CVE-2026-18504

A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application...