AutoPtT

AutoPtT AutoPtT enumera tickets Kerberos y realiza ataques Pass-the-Ticket PtT de forma interactiva o paso a paso. Es una alternativa independiente a Rubeus o Mimikatz para este ataque, implementada en C, C++, Crystal, Python y Rust. Puedes usar las siguientes opciones: auto - Ataque...

DumpGuard

DumpGuard DumpGuard es una herramienta de extracción de credenciales e investigación de protocolos para sistemas Windows modernos. Abusa del protocolo Remote Credential Guard para recuperar material de credenciales incluso cuando Credential Guard está habilitado, e incluye una ruta del paquete de...

kcmdump

KCM dumper Quick script to dump the KCM database used by SSSD and recover Kerberos tickets in the CCACHE format. Initially based on SSSDKCMExtractor and KCMTicketFormatter. Description Since version 2.0.0 2018-08-13, the back end storage of the KCM responder of SSSD does not encrypt the database...

PowershellKerberos

PowershellKerberos Algunos scripts para abusar de Kerberos usando Powershell. Mira el vídeo de uso Gracias a @BRIPWN YouTube Injector.ps1 Pequeña herramienta para inyectar tickets de Kerberos. Soporta dos modos de trabajo: Puedes leer el ticket desde un archivo kirbi modo 1 Puedes leer el ticket...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

mimikatz

mimikatz mimikatz es una herramienta que creé para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocida por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

nanorobeus

Nanorobeus Archivo COFF BOF para administrar tickets de Kerberos. Agentes compatibles Sliver Brute Ratel Cobalt Strike Comandos luid - obtener el ID de inicio de sesión actual sessions /luid: | /all - obtener sesiones de inicio de sesión klist /luid: | /all - listar tickets de Kerberos dump...

WonkaVision

WonkaVision WonkaVision es una herramienta de prueba de concepto POC para analizar tickets de Kerberos e intentar determinar si son falsificados. Esta herramienta fue creada por Charlie Clark y Andrew Schwartz. Cabe señalar que esta POC no está pensada para ser una aplicación empresarial lista pa...

mimikatz

mimikatz mimikatz es una herramienta que he creado para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocido por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

WCE

wce Wce es una excelente herramienta para la inyección de Hash; no solo sirve para la inyección de Hash, sino que también puede obtener directamente texto plano o Hash. Esta herramienta cuenta con versiones de 32 y 64 bits. ayuda Descripción de parámetros: l 列出登录的会话和NTLM凭据（默认值）； s 修改当前登录会话的NTLM凭据...

Astra Linux – Vulnerability in Samba

Kerberos acceptors need easy access to stable AD identifiers e.g., objectSid. Samba, as an AD DC, now provides a way for Linux applications to obtain a reliable SID and samAccountName from the issued tickets...

Astra Linux – Vulnerability in Samba

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on November 8, 2022, and according to RFC8429, it is assumed that RC4-HMAC is weak. Vulnerable Samba Active Directory Domain Controllers will issue RC4-HMAC encrypted tickets, even though the targe...

Weekly Metasploit Update: New Kerberos/Certificate tracing options, and multiple new modules

New Tracing Options As hard as we try to ensure that Metasploit is bug free, issues inevitably come up. Whether you’re running a module on an op or writing a new one, what we can do is make the debugging experience easier. To that end one of our two Google Summer of Code GSoC projects is here to...

rxrpc: reject undecryptable rxkad response tickets

...

Containing a domain compromise: How predictive shielding shut down lateral movement

In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001250 advisory. In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002903)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002903 advisory. In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the...

CLSA-2025-1761082525 Fix CVE(s): CVE-2022-45141

SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix session key selection algorithm for selecting the ticket in strongest-to-weakest order, thus allowing the target server to select better encryption - CVE-2022-45141...

SUSE CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

USN-7582-1: Samba vulnerabilities

Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. CVE-2022-3437 Greg Hudson discovered that Samba incorrectly handled PAC parsing. On...