zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

imposter

IMPOSTER A pentest tool used to attack windows clients on rogue networks. Current version Features Downgrade LDAP to NTLM authentication Fake initial steps of an domain controller to fool Network Location Awareness Servers DNS, CLDAP, LDAP Setup The current version have been tested on Kali Linux...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

CVE-2026-54121

CVE-2026-54121 Certighost This is a proof-of-concept tool to demonstrace CVE-2026-54121 a.k.a Certighost. Read here https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 for the detailed analysis. Install dependencies The proof of concept is a self-contained Python script. It requires...

ADLab

AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...

ADSpider

d8888 8888888b. .d8888b. d8b 888 d88888 888 "Y88b d88P Y88b Y8P 888 d88P888 888 888 Y88b. 888 /\ .-"""-. /\ d88P 888 888 888 "Y888b. 88888b. 888 .d88888 .d88b. 888d888 //\/ ,,, //\ d88P 888 888 888 "Y88b. 888 "88b 888 d88" 888 d8P Y8b 888P" |/| ,;;;;;, |/| d88P 888 888 888 "888 888 888 888 888...

cve-2020-1472

CVE-2020-1472 POC Replicate this vulnerability in a Windows domain environment using proxychains proxy on macOS. Environment DC Primary Domain Controller: Domain User Domain Member Host: Set up a SOCKS5 forward proxy directly via gost. Attack Hacker Attacker Machine: Configure proxychains4 vim...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

bloodyAD

⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...

Kestrel

Kestrel BloodHound shows you the path. Kestrel shows you what's already inside. Everyone maps the same thing: the attack path - who can reach Domain Admin. It's the right question, and the tools that answer it are excellent. But a graph of "who can reach whom" is blind to an entire class of...

CVE-2025-33073

CVE-2025-33073 Reflection Relay PoC Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled. 📋 Overview CVE-2025-33073 is a critical vulnerability that allows attackers to achieve SYSTEM-level code execution on Windows Domain...

printnightmare-detection-mitigation-lab

PrintNightmare Detection and Mitigation Lab A sanitised academic case study demonstrating how a Windows domain lab was designed, monitored and hardened while investigating CVE-2021-34527 PrintNightmare in a controlled virtual environment. Safety note: This repository focuses on systems...

attack_range

Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs — Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...

PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

CVE-2026-41089

CVE-2026-41089 — Windows Netlogon CLDAP Stack Buffer Overflow RCE Exploit CVE-ID: CVE-2026-41089 CVSS: 9.8 Critical CWE: CWE-121 Stack-based Buffer Overflow Attack Vector: UDP/389 CLDAP SearchRequest Impact: Remote Code Execution RCE / Denial of Service DoS Affected Versions: Windows Server 2012 ...

CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

ExtractBitlockerKeys

A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller's LDAP. Multithreaded connections to extract Bitlocker keys from LDAP. Iterate on LDAP result...

zer0dump

Zer0Dump Zer0dump is an PoC exploit/tool for abusing the vulnerabilities associated with CVE-2020-1472 Zerologon in order to initiate a full system takeover of an unpatched Windows domain controller. Special thanks to @dirkjanm and @SecureAuthCorp...

cve-2021-1675

〖EXP〗Ladon Printer Vulnerability Privilege Escalation CVE-2021-1675 Reproduction http://k8gege.org/p/CVE-2021-1675.html Overview On June 9, Microsoft released the June security update patch, fixing 50 security vulnerabilities, including a Windows Print Spooler privilege escalation vulnerability,...