bloodyAD

⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...

attack_range

Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs — Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...

zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

cve-2021-1675

〖EXP〗Ladon Printer Vulnerability Privilege Escalation CVE-2021-1675 Reproduction http://k8gege.org/p/CVE-2021-1675.html Overview On June 9, Microsoft released the June security update patch, fixing 50 security vulnerabilities, including a Windows Print Spooler privilege escalation vulnerability,...

cve-2019-1040-scanner

CVE-2019-1040 scanner Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target hosts and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx. Note...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

CVE-2026-41089

CVE-2026-41089 — Windows Netlogon CLDAP Stack Buffer Overflow RCE Exploit CVE-ID: CVE-2026-41089 CVSS: 9.8 Critical CWE: CWE-121 Stack-based Buffer Overflow Attack Vector: UDP/389 CLDAP SearchRequest Impact: Remote Code Execution RCE / Denial of Service DoS Affected Versions: Windows Server 2012 ...

ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

Zero-day-scanning

zeroscan Zeroscan is a Domain Controller vulnerability scanner, that currently includes checks for Zerologon CVE-2020-1472, MS-PAR/MS-RPRN and SMBv2 Signing. CVE-2020-1472: Uses a built-in script to check for Zerologon CVE-2020-1472, but does NOT attempt to exploit the target, it is simply a...

ADLab

AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

windows-coerced-authentication-methods

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...

ExtractBitlockerKeys

A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller's LDAP. Multithreaded connections to extract Bitlocker keys from LDAP. Iterate on LDAP result...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...

CVE-2026-54121

CVE-2026-54121 Certighost This is a proof-of-concept tool to demonstrace CVE-2026-54121 a.k.a Certighost. Read here https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 for the detailed analysis. Install dependencies The proof of concept is a self-contained Python script. It requires...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

CVE-2020-1472-LAB

ZeroLogon testing script A lab setup to test a vulnerability for the ZeroLogon exploit CVE-2020-1472. It contains a Python script that uses the Impacket library to test the vulnerability, and a Virtual Machine VM with Windows Server 2019 configured as a Domain Controller DC. The script attempts t...

cve-2020-1472

CVE-2020-1472 POC Replicate this vulnerability in a Windows domain environment using proxychains proxy on macOS. Environment DC Primary Domain Controller: Domain User Domain Member Host: Set up a SOCKS5 forward proxy directly via gost. Attack Hacker Attacker Machine: Configure proxychains4 vim...