adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

PoC-CVE-2022-26809

PoC-CVE-2022-26809 PoC for CVE-2022-26809, analisys and considerations are shown in the github.io. The PoC has been writtin overriding Impacket functions. Tested with: impacket version 0.10.0 The PoC has not been fully tested, because it should trigger the vulnerability, i.e integer overflow, tha...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

CVE-2021-31800-Impacket-SMB-Server-Arbitrary-file-read-write

CVE-2021-31800 - Impacket SMB Server Arbitrary file read/write CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Score : 9.9 Critical Description A path traversal in smbserver.py allows an attacker to read/write arbitrary files on the server. Detailed explanation of this issue:...

cve-2020-1472

cve-2020-1472 @toc Vulnerability Principle The principle is relatively complex. If interested, you can check the article at the following link: https://www.freebuf.com/articles/system/249860.html Exploitation 1. Modify the file impacket.dcerpc.v5.nrpc Need to use the...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472 - Zero Logon vulnerability Python implementation Description A Python script which uses the Impacket library to test for CVE-2020-1472 - Zerologon vulnerability credits to Secura research. The flaw stems from the Netlogon Remote Protocol, available on Windows domain...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

ZerologonWithImpacket-CVE2020-1472

Zerologon and Impacket Combination Exploit CVE-2020-1472 This repository contains an updated implementation 2024 of the Zerologon exploit combined with Impacket tools to exploit CVE-2020-1472 Zerologon. This exploit targets Windows Server environments to manipulate machine account passwords and...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Tested on a fully patched 2019 Domain Controller Execute malicious DLL's remote or locally Installation Before running the exploit you need t...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

CVE-2018-9276

CVE-2018-9276 CVE-2018-9276 PRTG 18.2.39 Reverse Shell Python3 support Dependancies Impacket python3 version Netcat Msfvenom Usage git clone https://github.com/A1vinSmith/CVE-2018-9276.git ./exploit.py -i targetIP -p targetPort --lhost hostIP --lport hostPort --user user --password pass 1. The...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

Kerberos_CVE-2022-33679

KerberosCVE-2022-33679 REQUIREMENTS impacket==0.10.0 arc4==0.3.0 USE case: CVE-2022-33079.py -h -ts -debug -dc-ip ip address target serverName...

lsassy

lsassy Python tool to remotely extract credentials on a set of hosts. This blog post explains how it works. This tool uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Chapters| Description ---|--- Warning| Before using this tool, read this...

Pachine

Pachine Python implementation for CVE-2021-42278 Active Directory Privilege Escalation. Installation $ pip3 install impacket Usage Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE -domain-netbios NETBIOSNAME -computer-name...