goshs

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...

CVE-2023-23397-PoW

CVE-2023-23397-PoW Proof of Work of CVE-2023-23397 for vulnerable Microsoft Outlook client application. For educational and research puproses only. CVE-2023-23397 preview This CVE aimed to retrieve NetNTLM hash logged in user from Microsoft Outlook client version 2016 except last patched version...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

CVE-2025-24071-Exploit

CVE-2025-24071-Exploit Đây chỉ là tài liệu mang tính chất học tập. Chỉ xem tham khảo và đừng làm phiền chính quyền. This content is for educational purposes only. Use for reference only and do not contact the police. Vulnerability Details CVE ID : CVE-2025-24071 Vulnerable System : NTLM Hash Leak...

CVE-2024-21413

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC 🚀 Usage Ensure you have appropriate permissions and authorization from the target system owner before using this script. Prerequisites Python 3.x impacket-smbserver Usage Example root@kitploit: sudo python3 CVE-2024-21413....

CVE-2026-54424

CVE-2026-54424 Parsec for Windows バージョン 150-104a を悪用して、以下を獲得する: SYSTEM としてのリモートコード実行 SYSTEM としての任意ファイル読み取り SYSTEM の NTLM ハッシュ取得 このエクスプロイトは同じ脆弱性に基づいていますが、実際の攻撃経路は異なります。 Technical writeup: https://www.tomadimitrie.dev/blog/CVE-2026-54424 Advisory:...

CVE-2025-24071_PoC

CVE-2025-24071 / CVE-2025-24054 PoC 수정: 마이크로소프트가 CVE-2025-24071을 CVE-2025-24054로 이름 변경 🤔 개요 이 Windows 취약점은 특히 'explorer.exe'에서 발생하며, 공격자가 .zip 파일을 추출하도록 하는 것만으로 피해자로부터 NetNTLMv2 해시를 얻을 수 있습니다. 사용법 스크립트 실행 root@kitploit: python PoC.py test 192.168.1.45 "exploit.zip"을 대상에게 전송한 후, Responder를 사용하여...

CVE-2024-43451-POC

Description Name : CVE-2024-43451 CVSSv3 Score : 6.5 Affected Versions : All Microsoft Windows versions before the Nov 2024 Patch CVE-2024-43451 is a zero-day vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes with minimal interaction from the user,...

Project-NTLM-Hash-Capture-and-Phishing-Email-Exploitation-for-CVE-2024-21413

Project Goal: The project was created to demonstrate the use of various tools for capturing NTLM hashes from users on a network and for executing phishing attacks using email. This showcases how network authentication vulnerabilities and phishing methods can be exploited to compromise systems...

CVE-2020-13941

CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr Multiple Solr endpoints have been found to accept absolute paths. In Windows systems these absolute path can be forced to make the OS connect to an attacker-controlled SMB server. This behaviour may result in attacks such as...

Responder

⛔ DEPRECATED Active at https://github.com/lgandx/Responder Responder.py LLMNR/NBT-NS/mDNS 포이즈너 저자: Laurent Gaffie http://www.spiderlabs.com 소개 Responder는 LLMNR, NBT-NS 및 MDNS 포이즈너입니다. 특정 NBT-NS NetBIOS 이름 서비스 쿼리에 이름 접미사에 따라 응답합니다 참조: http://support.microsoft.com/kb/163409. 기본적으로 이 도구는 파일 서버 서비스...

cyanide

Cyanideとは？ 名前が示すように、これは毒です。Cyanideは基本的に、さまざまなポイズニング手法 現在はResponderのみ を関連付けるためのトラッカーであり、キャプチャしたハッシュをImpacketのntlmrelayx.pyを介してリレーします。起動時には、既定でSMB・HTTP・DNSサーバーを無効にしたResponderと、SMBおよびHTTPサーバーを有効にしたNtlmrelayxを開始します。出力には次の情報が表示されます: 1. ポイズニングソース ポイズナー 例: responder ポイズン方法 例: LLMNR、NBT-NS、MDNS...

CVE-2026-32202

免責事項 このツールは許可されたレッドチーム演習およびペネトレーションテスト 専用です。 明示的な許可なくシステムに対して不正に使用することは違法です。 自己責任で使用してください。作者は、誤用や損害について一切の責任を負いません。 説明 不完全なWindows...

CVE-2024-21413

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC 🚀 Usage Ensure you have appropriate permissions and authorization from the target system owner before using this script. Prerequisites Python 3.x impacket-smbserver Usage Example root@kitploit: sudo python3 CVE-2024-21413....

monikerlinktest

monikerlinktest cve-2024-21413 1. 任意のovpnファイルでopenvpnを使用して、ルーター上にtun0または他のtunを設定します 2. まだインストールしていない場合はremminaをインストールします 3. 接続したovpnのポートでremminaを使用してターゲットデスクトップにRDP接続します（重複している場合はダウンしている方をip link deleteで削除します） 4. exploit.pyのコマンドに従って、すべてのプレースホルダーを置き換えます 5. responderを起動します 6. 'python3...

Windows Snipping Tool - NTLMv2 Hash Hijack

Exploit Title: Windows Snipping Tool - NTLMv2 Hash Hijack Date: 2026-04-22 Exploit Author: nu11secur1ty Video Demo: https://www.patreon.com/posts/cve-2026-33829-156243398 Vendor Homepage: https://www.microsoft.com Software Link: Built-in Windows Snipping Tool Version: Windows 10, Windows 11,...

Rockwell Automation Studio 5000 Simulation Interface Server-Side Request Forgery Vulnerability

Rockwell Automation Studio 5000 Simulation Interface is a simulation modeling tool from Rockwell Automation. The Rockwell Automation Studio 5000 Simulation Interface suffers from a server-side request forgery vulnerability that stems from the server not implementing sufficient authentication...

CVE-2024-45301 ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability

Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an...

CVE-2025-11696

A local server-side request forgery SSRF security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes...

CVE-2025-11696 Studio 5000 ® Simulation Interface SSRF

A local server-side request forgery SSRF security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes...