731 matches found
zerologon
ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...
bloodyAD
⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...
ad-ldap-enum
ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...
CVE-2021-1675
From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 🚨 Patch released: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 The patch has been confirmed to fix RCE however local priviledge escalation appears to not be patched as of yet. Therefore...
attack_range
Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs — Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...
redteam-research
Red Team Research Collection of PoC and offensive techniques used by the BlackArrow Red Team License All the code included in this project is licensed under the terms of the MIT license...
ADLab
AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...
CVE-2020-1472
CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...
automato
automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...
CVE-2020-1472
CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...
kerberoast
🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...
CVE-2026-54121
CVE-2026-54121 Certighost これは、CVE-2026-54121（別名 Certighost ）を実証するための概念実証ツールです。詳細な分析についてはこちら https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 をお読みください。 依存関係のインストール この概念実証は自己完結型のPythonスクリプトです。impacket、cryptography、pyasn1、asn1crypto、およびdnspythonが必要です。 root@kitploit: sudo pip install...
ADSpider
d8888 8888888b. .d8888b. d8b 888 d88888 888 "Y88b d88P Y88b Y8P 888 d88P888 888 888 Y88b. 888 /\ .-"""-. /\ d88P 888 888 888 "Y888b. 88888b. 888 .d88888 .d88b. 888d888 /// ,,, //\ d88P 888 888 888 "Y88b. 888 "88b 888 d88" 888 d8P Y8b 888P" |/| ,;;;;;, |/| d88P 888 888 888 "888 888 888 888 888 888...
ntlm-scanner
새 기능! CVE-2020-1472 ZeroLogon 익스플로잇 스캔 네트워크의 DC를 스캔하여 CVE-2020-1472의 실제 익스플로잇을 탐지합니다. 예시: root@kitploit: python scan.py -vuln CVE-2020-1472 -target-file targets.txt python scan.py -vuln CVE-2020-1472 -target 이 도구는 매분마다 DC에 대해 빈 암호를 시도하는 방식으로 작동합니다. 익스플로잇은 암호를 빈 값으로 설정해야 하므로, 매우 빠르게 되돌리지 않는 한 익스플로...
zerologon
ZeroLogon 익스플로잇 스크립트 익스플로잇 코드는 https://www.secura.com/blog/zero-logon 및 https://github.com/SecuraBV/CVE-2020-1472 를 기반으로 합니다. 원본 연구 및 스캐너는 Secura, 수정은 RiskSense Inc.가 담당했습니다. 익스플로잇을 위해, 기존에 설치된 Impacket을 모두 제거하고 https://github.com/SecureAuthCorp/impacket/commit/b867b21 또는 그 이상 버전의 Impacket을 설치하세요...
DCSYNCMonitor
DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...
SharpSniper
SharpSniper 종종 레드팀 모의 침투는 단순히 Domain Admin을 획득하는 것 이상을 목표로 합니다. 일부 고객은 특정 도메인 사용자예: CEO가 침해될 수 있는지 확인하기를 원합니다. SharpSniper는 이러한 사용자의 IP 주소를 찾아 해당 머신을 타겟팅할 수 있도록 도와주는 간단한 도구입니다. 이 도구를 사용하려면 도메인 컨트롤러의 로그를 읽을 수 있는 권한이 있어야 합니다. 먼저 도메인 컨트롤러 목록을 조회하여 만든 다음, 찾고자 하는 사용자에 대해 DC에서 로그온 이벤트를 검색하고 가장 최근 DHCP ...
ZeroLogon-CVE-2020-1472-lab
ZeroLogon-CVE-2020-1472 ZeroLogon 취약점CVE-2020-1472에 대한 설명 및 시연 이 연구실의 목적은 순전히 교육용입니다. 프로덕션 환경이나 귀하의 소유가 아닌 환경에서 실행하는 것은 권장되지 않습니다. 취약점에 관하여 취약점 개요 이 취약점을 통해 사이버 범죄자는 도메인 컨트롤러DC를 장악할 수 있습니다. 이는 컨트롤러의 서비스 계정 비밀번호를 변경하거나 제거함으로써 이루어집니다. 악의적인 공격자는 단순히 서비스 거부를 유발하거나 제어권을 장악하여 전체 네트워크를 소유할 수 있습니다. 2020년...
cve-2020-1472
CVE-2020-1472 POC mac環境でproxychainsプロキシを介してWindowsドメイン環境でこの脆弱性を再現する。 Environment DCプライマリドメインコントローラー: Domain Userドメインメンバーホスト: gostを使用してsocks5フォワードプロキシを直接設定する。 Attack Hacker攻撃マシン: proxychains4を設定する root@kitploit: vim /Users/xq17/.proxychains/proxychains.conf PrxoyListリストを追加する ProxyList socks5...