CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation...

dconstruct

dconstruct Open the source MP4 dconstruct is a reverse engineering tool for the DC-Script files used in The Last of Us Part II. It features a disassembler and a decompiler. It outputs .asm files containing the disassembled structures and bytecode, aswell as .dcpl DC Pseudo Language files containi...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

dc-sonar

Comunidad DC Sonar Repositorios El proyecto consiste en los repositorios: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Aviso legal Es solo con fines educativos. Evite usarlo en un dominio de Active Directory AD de producción. Ningún colaborador asume responsabilid...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

CVE-2019-1040

CVE-2019-1040 Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote CVE-2019-1040.py for easy to use. You can also check out my exchange2domain repo: https://github.com/ridter/exchange2domain, another way to use exchange to get DC...

SharpPrivesc

SharpPrivesc Practicing C and bringing Privesc attack surfaces together. Still noob stuff. Privesc checks and the like. I preferred Spectreops command line parsing classes so decided to utilize theirs over other .net packages like command line parser etc. To-Do: Menu More Privesc Check modules...

DCSYNCMonitor

DCSYNCMonitor Descripción Esta herramienta es una aplicación/servicio que se puede implementar en controladores de dominio para alertar sobre intentos de sincronización de Controladores de Dominio. Cuando se detecta un intento, la herramienta escribe un evento en el Registro de Eventos de Windows...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "Penetration testing lab writeups documenting full attack chains — from recon to root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Difficulty: Beginner–Intermediate Platform: VulnHub Goal: Capture all 4 flags and achieve full root-level compromise Attacker OS: Kali Linux VirtualBox...

EIPP

EIPP Banned Password Lists Tools for manipulating Banned Password Lists BPL of Entra ID Password Protection. The eipp-global-bpl.txt containing the entries of the global banned password list was dumped on 2024-04-11. More info at...

ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire unauthorized data stored within the Now Platform. Note that Nessus has n...

PoC-CVE-2020-9715

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only. Vulnerability Adobe Acrobat Reader DC = 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding ANSI or...

CVE-2023-22515

CVE-2023-22515: Confluence Data Center & Server Privilege Escalation Vulnerability Analysis Report 1. Overview CVE-2023-22515 is a critical Broken Access Control vulnerability discovered in Atlassian Confluence Data Center and Server products. An unauthenticated attacker can remotely reactivate...

ServiceNow - Incomplete Input Validation

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addresse...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed the potential null dereference issue. The adev-dm.dc pointer can be NULL, and it may be dereferenced in amdgpudmfini without any checks. A NULL pointer check should be added before calling dcdmubsrvdestroy...

ANT-2026-WG9N02WM · libjxl · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-WG9N02WM: Heap buffer overflow in fast...

CVE-2026-68436

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability occurs when the struct dc data structure, which is used for display management, grows beyond a certain memory allocation limit. When this limit is exceeded, the system fails to allocate the necessary memory,...

CVE-2026-68436

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time most of it the two inlined dcscratchspace copies and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual siz...