CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

RemoteKrbRelay

root@kitploit: //, ,//\ \ / \ \ XXX XXX / //, \o-o/-o-o/ / / \ XXX | / \ / ,-/ / \ / /,| | \ | / \ / ,-,,,/ ,,, CICADA8 Research Team From Michael Zhmaylo MzHmO RemoteKrbRelay You probably know KrbRelay and KrbRelayUp, but what if I told you it could be done remotely? With RemoteKrbRelay...

DCOMrade

DCOMrade DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script...

CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath root@kitploit: SharpMove.exe action=que...

DCOMIllusionist

🎩✨🪄 DCOMIllusionist Windows fileless lateral movement technique. Introduction • Build • Usage • Technical Details • Acknowledgements Introduction This tool enables remote code execution on a Windows machine, if you have administrative privileges. It leverages DCOM and the behavior of .NET DCOM...

CobaltStrike-BOF

CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...

ADCSDevilCOM

ADCSDevilCOM A C tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly. !WARNING Use only in...

ExploitDotNetDCOM

ExploitDotNetDCOM c James Forshaw 2014 Una herramienta para explotar .NET DCOM para EoP y RCE. Está corregido en las últimas versiones de .NET. Solo para fines informativos. Todo el código está licenciado bajo GPLv3...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

MiscTools

MiscTools CsExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context of a privileged user. root@kitploit: CsExec.exe Also see TikiService. CsPosh Command Exec / Lateral Movement via PowerShell. Creates a PowerShell runspace on a remote target. Must be...

DVS

DCOM Vulnerability Scanner AKA Devious swiss army knife - Lateral movement using DCOM Objects Did you ever wonder how you can move laterally through internal networks? or interact with remote machines without alerting EDRs? Let's assume that we have a valid credentials, or an active session with...

GodPotato

GodPotato Based on the history of Potato privilege escalation for 6 years, from the beginning of RottenPotato to the end of JuicyPotatoNG, I discovered a new technology by researching DCOM, which enables privilege escalation in Windows 2012 - Windows 2022, now as long as you have...

Kernelhub

CVE-2003-0352 Describe Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. ImpactVersion Product| C...

dcomhijack

DCOM DLL Hijacking We recently discovered the following DCOM classes that are subject to DLL hijacking. If an attacker can write to the associated path, they can move laterally by instantiating the COM object. Some classes have additional DLL hijacking opportunities that are not listed here...

DCOMUploadExec

DCOM Upload & Execute DCOM Lateral movement POC abusing the IMsiServer interface https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor The solution contains 2 projects DCOMUploadExec - A C++ project which hosts the lateral movement attack code AssemblyPayload - A .NET DLL...

RemoteMonologue

RemoteMonologue RemoteMonologue es una técnica de recolección de credenciales de Windows que permite comprometer usuarios de forma remota aprovechando la clave RunAs del usuario interactivo y forzando autenticaciones NTLM mediante DCOM. Lea RemoteMonologue: Weaponizing DCOM for NTLM Authenticatio...

DLHell

DLHell DLHell performs DCOM local & remote Windows DLL Proxying. Install The following packages are required might depend on your distro, the following example is for Debian 12: root@kitploit: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Install pip dependencies:...

RemoteMonologue

RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...