Invoke-BadSuccessor.ps1

Invoke-BadSuccessor Abuse Delegated Managed Service Accounts dMSA creation rights on vulnerable Organizational Units OUs to escalate privileges in Active Directory environments BadSuccessor vulnerability – CVE-2025-53779. Overview Invoke-BadSuccessor automates a privilege escalation attack chain ...

SharpSuccessor

SharpSuccessor SharpSuccessor is a .NET Proof of Concept POC for fully weaponizing Yuval Gordon’s @YuG0rd BadSuccessor attack from Akamai. A low privilege user with CreateChild permissions over any Organizational Unit OU in the Active Directory domain with write access on a target object can...

OS Command Injection

priest-runner is vulnerable to OS command injection. The vulnerability exists as it passes unsanitized input into a spawn call through a POST request into PriestController.prototype.createChild...

Command Injection in priest-runner

All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the spawn...

Command Injection

Overview All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the...