ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

dc-sonar

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid using it on the production Active Directory AD domain. Neither contributor incur any responsibilit...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

dconstruct

dconstruct Open the source MP4 dconstruct is a reverse engineering tool for the DC-Script files used in The Last of Us Part II. It features a disassembler and a decompiler. It outputs .asm files containing the disassembled structures and bytecode, aswell as .dcpl DC Pseudo Language files containi...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "Penetration testing lab writeups documenting full attack chains — from recon to root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Difficulty: Beginner–Intermediate Platform: VulnHub Goal: Capture all 4 flags and achieve full root-level compromise Attacker OS: Kali Linux VirtualBox...

SharpPrivesc

SharpPrivesc Practicing C and bringing Privesc attack surfaces together. Still noob stuff. Privesc checks and the like. I preferred Spectreops command line parsing classes so decided to utilize theirs over other .net packages like command line parser etc. To-Do: Menu More Privesc Check modules...

PoC-CVE-2020-9715

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only. Vulnerability Adobe Acrobat Reader DC = 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding ANSI or...

CVE-2023-22515

CVE-2023-22515: Confluence Data Center & Server Privilege Escalation Vulnerability Analysis Report 1. Overview CVE-2023-22515 is a critical Broken Access Control vulnerability discovered in Atlassian Confluence Data Center and Server products. An unauthenticated attacker can remotely reactivate...

Exchange2domain

Exchange2domain All in One tools of privexchange . You only need to open the web server port, so no high privileges are required. Great writeup! Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation 👋 Overview CVE-2026-54121 "Certighost" is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services AD CS. The vulnerability allows an authenticated...

CLEANSTART-2024-SX99607 use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control

Security vulnerability affects the samba package. A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control...

CLEANSTART-2024-VO33485 flaw was found in the AD DC NBT server in all Samba versions before 4

Security vulnerability affects the samba package. A flaw was found in the AD DC NBT server in all Samba versions before 4...

CLEANSTART-2024-VV27874 MaxQueryDuration not honoured in Samba AD DC LDAP

Security vulnerability affects the samba package. MaxQueryDuration not honoured in Samba AD DC LDAP...

CLEANSTART-2024-WI60388 Acrobat Reader DC versions versions 2021

Security vulnerability affects the tor package. Acrobat Reader DC versions versions 2021...

EIPP

EIPP Banned Password Lists Tools for manipulating Banned Password Lists BPL of Entra ID Password Protection. The eipp-global-bpl.txt containing the entries of the global banned password list was dumped on 2024-04-11. More info at...

CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

Malicious code in test-01-rafamarrara-learning-dc (PyPI)

Source: kam193 c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816 Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. --- Category:...

MAL-2026-18402 Malicious code in test-01-rafamarrara-learning-dc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612 Package appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or...