pyGPOAbuse

pyGPOAbuse Adiciones de Filtro por D4RKMATT3R AVISO: Esto solo se probó brevemente en un entorno AD local. No me responsabilizo por ningún comportamiento imprevisto o mal funcionamiento; se proporciona tal cual, solo para pruebas autorizadas, bajo su propio riesgo. Ahora admite segmentación...

Grouper

Grouper 不要再使用Grouper了。请使用Grouper2！ https://github.com/l0ss/Grouper2 一个用于帮助发现Active Directory组策略中易受攻击设置的PowerShell脚本。 照片由Jon Hanson拍摄 - https://www.flickr.com/people/61952179@N00?rb=1 - https://creativecommons.org/licenses/by-sa/2.0/ 概述...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse 是一个用 C 编写的 .NET 应用程序，可用于利用用户对组策略对象（GPO）的编辑权限，来破坏该 GPO 所控制的对象。 更多详细信息可在以下博客文章中找到：https://labs.mwrinfosecurity.com/tools/sharpgpoabuse 编译说明 确保必要的 NuGet 包已正确安装，然后在 Visual Studio 中直接生成项目。 使用方法 用法： SharpGPOAbuse.exe 攻击类型 目前 SharpGPOAbuse 支持以下选项： 选项| 描述 ---|---...

MDE-AuditCheck

MDE-AuditCheck 确保 MDE 所依赖的所有审核设置在 GPO 中均已正确设置 该脚本依赖于远程服务器管理工具 RSAT。...

GroupPolicyBackdoor

GroupPolicyBackdoor GroupPolicyBackdoor 是一个用于操作和利用组策略对象（GPO）的 Python 工具。GPO 攻击向量在 Active Directory 环境中常常可以导致具有重大影响的权限提升场景。然而，攻击性安全专业人员可能不愿使用它们，部分原因是与 GPO 操作相关的感知风险。 GroupPolicyBackdoor 旨在提供一个模块化、稳定且隐蔽的 GPO 攻击向量利用框架，全部使用 Python 实现。该工具已在 DEFCON 33 上展示。 文档 使用说明（快速或详细）在仓库的 wiki...

adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

SeriousSam

Windows 权限提升漏洞 CVE-2021-36934 SeriousSAM 说明请参见微软文章： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 通过 GPO 部署临时解决方案 将以下命令复制粘贴到记事本中，保存为批处理文件（.bat 扩展名），然后通过 GPO 推送到 Windows 机器上。 @echo off icacls %windir%\system32\config. /inheritance:e vssadmin delete shadows /all /quiet...

CVE-2024-20674

CVE-2024-20674 这是我针对公开漏洞CVE-2024-20674的利用实现，利用客户端处理Kerberos U2U TGT-REP时的逻辑漏洞实现Kerberos双向认证绕过。 例如，当向客户端伪造DC时，可利用此漏洞提供任意GPO，并控制目标机器。 前提条件 ：网络中间人攻击，无需认证。 论文中漏洞的详细解释 https://www.sstic.org/2025/presentation/loutillagereseauwindowsuneaffairedimplementation/ 演示...

gpblib

GPBLib GPBLib 包含 GroupPolicyBackdoor、OUned 和 GPOddity 项目在进行 GPO 操作时所用的公共代码。...

WindowsFirewallRuleset

Windows Firewall 规则集 !替代文本corporate firewall 目录 Windows 防火墙规则集 目录 关于 Windows 防火墙规则集 防火墙规则 防火墙框架 本防火墙的愿景 许可证 要求 要求详情 我不满足要求 首次用户 警告 注意 快速入门 防火墙管理 自动和交互式防火墙部署 管理 GPO 规则 部署单独规则集 删除规则 导出/导入规则 远程防火墙部署 支持、更新和文档 未来 关于 Windows 防火墙规则集 !Alpha 版本badge statusalpha 一个基于 PowerShell 的 Windows 防火墙全自动化解决方案 Window...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785345275)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785345275 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches th...

Rocky Linux 8 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_3270)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243270 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Tenable has extracted the preceding description block...

CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1785845028)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1785845028 advisory. - A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the enti...

Rocky Linux 9 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2024_2571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242571 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Bug Fixes: socket leak JIRA:Rocky Linux-22340 Passkey canno...

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Executive summary In April 2026, we at Kaspersky's Global Emergency Response Team GERT responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization's Active Directory environment and authored a...

ROS-20260921-73-0110

The vulnerability of the GPO group policy management component of the Samba software is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent existing security restrictions...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3314)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3389)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

TencentOS Server 2: sssd (TSSA-2026:0944)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0944 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 3: sssd (TSSA-2026:0846)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0846 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...