CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS विशेषाधिकार वृद्धि 👋 अवलोकन CVE-2026-54121 "Certighost" एक उच्च-गंभीरता वाली विशेषाधिकार वृद्धि भेद्यता है जो Microsoft Active Directory Certificate Services AD CS को प्रभावित करती है। यह भेद्यता एक प्रमाणित डोमेन उपयोगकर्त...

dconstruct

dconstruct Open the source MP4 dconstruct is a reverse engineering tool for the DC-Script files used in The Last of Us Part II. It features a disassembler and a decompiler. It outputs .asm files containing the disassembled structures and bytecode, aswell as .dcpl DC Pseudo Language files containi...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

dc-sonar

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid using it on the production Active Directory AD domain. Neither contributor incur any responsibilit...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

CVE-2019-1040

CVE-2019-1040 Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote CVE-2019-1040.py for easy to use. You can also check out my exchange2domain repo: https://github.com/ridter/exchange2domain, another way to use exchange to get DC...

SharpPrivesc

SharpPrivesc Practicing C and bringing Privesc attack surfaces together. Still noob stuff. Privesc checks and the like. I preferred Spectreops command line parsing classes so decided to utilize theirs over other .net packages like command line parser etc. To-Do: Menu More Privesc Check modules...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "توثيقات لاختبارات اختراق مخبرية تغطي سلاسل الهجوم الكاملة — من الاستطلاع حتى الجذر." 🔓 VulnHub — DC-1 — توثيق اختراق حتى الجذر Boot-to-Root الصعوبة: مبتدئ–متوسط المنصة: VulnHub الهدف: التقاط جميع الأعلام الأربعة وتحقيق اختراق كامل بصلاحيات الجذر نظام المهاجم: Kali Linux...

EIPP

قوائم كلمات المرور المحظورة EIPP أدوات للتعامل مع قوائم كلمات المرور المحظورة BPL الخاصة بحماية كلمات مرور Entra ID. تم تفريغ ملف eipp-global-bpl.txt الذي يحتوي على إدخالات قائمة كلمات المرور المحظورة العامة في 2024-04-11. مزيد من المعلومات على...

ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire unauthorized data stored within the Now Platform. Note that Nessus has n...

PoC-CVE-2020-9715

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only. Vulnerability Adobe Acrobat Reader DC = 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding ANSI or...

CVE-2023-22515

CVE-2023-22515: Confluence Data Center & Server Privilege Escalation Vulnerability Analysis Report 1. Overview CVE-2023-22515 is a critical Broken Access Control vulnerability discovered in Atlassian Confluence Data Center and Server products. An unauthenticated attacker can remotely reactivate...

ServiceNow - Incomplete Input Validation

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addresse...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed the potential null dereference issue. The adev-dm.dc pointer can be NULL, and it may be dereferenced in amdgpudmfini without any checks. A NULL pointer check should be added before calling dcdmubsrvdestroy...

ANT-2026-WG9N02WM · libjxl · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-WG9N02WM: Heap buffer overflow in fast...

CVE-2026-68436

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability occurs when the struct dc data structure, which is used for display management, grows beyond a certain memory allocation limit. When this limit is exceeded, the system fails to allocate the necessary memory,...

CVE-2026-68436

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time most of it the two inlined dcscratchspace copies and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual siz...