authproof-sdk

AuthProof SDK AuthProof is a cryptographic delegation protocol for agentic AI. Most protocols in this space enforce against an operator-defined policy -- giving the operator authority to expand or reinterpret the user's original intent after the fact. AuthProof is built around a different trust...

CVE-2026-83189

Oracle User Management (component: Proxy User Delegation ) in Oracle E-Business Suite versions 12.2.3–12.2.15 is vulnerable to a high-severity flaw (CVSS 3.1: 8.8 ) that allows a low-privileged attacker with network access via HTTP to take over the Oracle User Management component. The attack req...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 Elevation of Privilege Vulnerability Description The Modify Computers is a predefined role in ADManager for managing computers. If a technician user has the Modify Computers privilege over a computer, they can change the userAccountControl and...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level. It can be used to delegate and take over the inbox of other users including domain administrators after obtaining the credentials of a regular mailbox account. This EXP script is an enhanced...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

Rubeus

Rubeus Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard component...

StandIn

StandIn StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation. However, StandIn quickly ballooned to include a number of comfort features. I want to continue developing...

subjack

subjack DNS 인수 스캐너 Subjack은 Go로 작성된 DNS 인수 스캐너로, 도메인 목록을 동시에 스캔하여 하이재킹이 가능한 도메인을 식별하도록 설계되었습니다. Go의 속도와 효율성 덕분에 이 도구는 대량 테스트에서 특히 두드러집니다. 가양성을 배제하기 위해 결과를 항상 수동으로 다시 확인하세요. Subjack이 감지하는 항목: CNAME 인수 — 청구되지 않은 타사 서비스를 가리키는 방치된 CNAME NS 위임 인수 — 만료된 네임서버 도메인 및 방치된 클라우드 DNS 영역 Route 53, Google Cloud...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level Once you have the credentials of an ordinary mailbox account, it allows you to delegate and take over the inboxes of other users including domain administrators This EXP script is an enhanced...

krbrelayx

Krbrelayx - Kerberosリレーと非制約委任の悪用ツールキット Kerberos を悪用するためのツールキットです。 動作には impacket、ldap3、dnspython が必要です。 最新版を利用できるよう、impacket は git から直接インストールすることをお勧めします。 このツールキットの詳細は私のブログ https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/ を参照してください。Kerberos リレーの情報は続編ブログ...

CVE-2020-1350

CVE-2020-1350 SIGRed Denial of Service PoC Exploit This repo has my version of a DoS PoC exploit for the SIGRed vulnerability disclosed by MS and Check Point Research on July 14th, 2020. @maxpl0it also wrote a PoC that he published on July 15th, but I structured my exploit a little differently th...

Get-RBCD-Threaded

Get-RBCD-Threaded Active Directory 환경에서 리소스 기반 제한 위임RBCD 공격 경로를 찾는 도구 거의 전적으로 Elad Shamir의 훌륭한 블로그 게시물 "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory"와 harmj0y의 "A Case Study in Wagging the Dog: Computer Takeover"를 기반으로 합니다. 실제로 여기서 무슨 일이 일어나고 있는지 이해하고...

zBang

zBang is a special risk assessment tool that detects potential privileged account threats in the scanned network. Organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network. The results can be analyzed with the graphic...

CVE-2019-1040-dcpwn

CVE-2019-1040-dcpwn 훌륭한 글입니다! CVE-2019-1040 악용 - RCE 및 도메인 관리자 권한 획득을 위한 릴레이 취약점 결합 . 그래서 사용하기 쉽게 dcpwn.py를 작성했습니다. 요구 사항 이 도구들은 impacket이 필요합니다. pip로 설치할 수 있습니다. root@kitploit: pip install impacket 사용법 root@kitploit: usage: dcpwn.py -h -u USERNAME -p PASSWORD --hashes HASHES -d DOMAIN --smb-port...

KerberosRun

KerberosRun KerberosRun is a little tool I use to study AD security together with my ADCollector. KerberosRun uses the Kerberos.NET library built by Steve Syfuhs. Some code were taken and adapted from Harmj0y's Rubeus project. dev2null is the primary author of this project. My colleague Constanti...

remote-control

Laravel 远程控制 在不共享凭据的情况下授予用户帐户远程访问权限。 安装 配置 用法 路由 创建远程访问 使用生成的访问令牌 安装 Remote Control 可以通过 Composer 安装： root@kitploit: composer require "katsana/remote-control" 配置 该软件包将自动注册一个服务提供者。 接下来，你需要发布 Remote Control 的配置文件： root@kitploit: php artisan vendor:publish...

CVE-2026-73470

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

Change-Lockscreen

Change-Lockscreen Change-Lockscreen は、Windows のロック画面画像をコマンドラインから変更することで、SYSTEM としてネットワーク認証をトリガーし、以下のリンク先の投稿で説明されているような権限昇格攻撃を実行するためのツールです: https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation 特徴 既定では、Windows...

CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

EUVD-2026-77464

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...