adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

pyGPOAbuse

pyGPOAbuse Aggiunte di Filtri di D4RKMATT3R AVVISO: Questo è stato testato solo brevemente in un ambiente AD locale; non mi assumo alcuna responsabilità per comportamenti imprevisti o malfunzionamenti. Viene fornito così com'è, solo per test autorizzati, interamente a proprio rischio. Ora support...

MDE-AuditCheck

MDE-AuditCheck Garantisce che tutte le impostazioni di controllo su cui MDE fa affidamento siano configurate correttamente nel GPO Lo script si basa su Remote Server Administration Tools RSAT...

Grouper

Grouper NON USARE PIÙ GROUPER. USA GROUPER2! https://github.com/l0ss/Grouper2 Uno script PowerShell per aiutare a trovare impostazioni vulnerabili nelle Criteri di Gruppo AD. Foto di Jon Hanson - https://www.flickr.com/people/61952179@N00?rb=1 - https://creativecommons.org/licenses/by-sa/2.0/...

SeriousSam

Vulnerabilità di elevazione dei privilegi in Windows CVE-2021-36934 SeriousSAM Descrizione nell'articolo Microsoft: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 Per distribuire la soluzione alternativa tramite GPO Copia e incolla i comandi seguenti nel blocco note, salva...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse è un'applicazione .NET scritta in C che può essere utilizzata per sfruttare i diritti di modifica di un utente su un Oggetto Criterio di Gruppo GPO al fine di compromettere gli oggetti controllati da tale GPO. Maggiori dettagli sono disponibili nel seguente post del...

GroupPolicyBackdoor

GroupPolicyBackdoor GroupPolicyBackdoor è uno strumento Python per la manipolazione e lo sfruttamento degli oggetti Criteri di gruppo GPO. I vettori d'attacco basati su GPO possono molto spesso portare a scenari di escalation dei privilegi di grande impatto in ambienti Active Directory. Eppure, i...

gpblib

GPBLib GPBLib contiene il codice comune utilizzato dai progetti GroupPolicyBackdoor, OUned e GPOddity per le manipolazioni delle GPO...

CVE-2024-20674

CVE-2024-20674 Questa è la mia implementazione di un exploit della CVE pubblica CVE-2024-20674 per ottenere il bypass dell'autenticazione reciproca Kerberos utilizzando un bug logico nella gestione lato client delle risposte TGT-REP U2U di Kerberos. Può essere utilizzato, ad esempio, per servire...

WindowsFirewallRuleset

Regole del Firewall di Windows !Alt Textcorporate firewall Indice Regole del Firewall di Windows Indice Informazioni su Windows Firewall Ruleset Regole del firewall Framework del firewall La visione di questo firewall Licenza Requisiti Dettagli sui requisiti Non soddisfare i requisiti Primo...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785345275)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785345275 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches th...

Rocky Linux 8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_3270)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243270 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785345275)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785345275 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the...

CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1785845028)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1785845028 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the enti...

Rocky Linux 9 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_2571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242571 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Bug Fixes: socket leak JIRA:Rocky Linux-22340 Passkey canno...

AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784804056)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784804056 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the...

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Executive summary In April 2026, we at Kaspersky's Global Emergency Response Team GERT responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization's Active Directory environment and authored a...

ROS-20260921-73-0110

The vulnerability of the GPO group policy management component of the Samba software is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent existing security restrictions...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3314)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3389)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...