DumpGuard

DumpGuard DumpGuard 是一款针对现代 Windows 系统的凭据转储与协议研究工具。它滥用 Remote Credential Guard 协议，即使在启用了 Credential Guard 的情况下也能恢复凭据材料，同时还包含了一条用于面向会话的 NTLM 提取的 Microsoft v1 身份验证包路径。 当前功能包括： NTLMv1 响应 NTLMv2 响应 Kerberos 服务票据 用于本地登录会话的 Microsoft v1 身份验证包转储 你可以从本仓库的发布版块下载预构建的二进制文件。 免责声明：...

PowershellKerberos

PowershellKerberos Algunos scripts para abusar de Kerberos usando Powershell. Mira el vídeo de uso Gracias a @BRIPWN YouTube Injector.ps1 Pequeña herramienta para inyectar tickets de Kerberos. Soporta dos modos de trabajo: Puedes leer el ticket desde un archivo kirbi modo 1 Puedes leer el ticket...

kcmdump

KCM dumper Quick script to dump the KCM database used by SSSD and recover Kerberos tickets in the CCACHE format. Initially based on SSSDKCMExtractor and KCMTicketFormatter. Description Since version 2.0.0 2018-08-13, the back end storage of the KCM responder of SSSD does not encrypt the database...

AutoPtT

AutoPtT AutoPtT 枚举 Kerberos 票证并以交互式或逐步方式执行传递票证 PtT 攻击。它是此攻击的独立替代方案，替代 Rubeus 或 Mimikatz，使用 C、C++、Crystal、Python 和 Rust 实现。 你可以使用以下选项： auto - 自动化传递票证攻击 sessions - 列出登录会话。类似于运行 klist sessions klist - 列出当前会话中的票证。类似于运行 klist tickets - 列出所有会话中的票证（不仅仅是 TGT）。类似于运行 Rubeus.exe dump export - 根据 LogonId...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...

mimikatz

mimikatz mimikatz 是我为了学习 C 语言并对 Windows 安全进行一些实验而制作的一款工具。 如今它以从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据而闻名。mimikatz 还可以执行哈希传递（pass-the-hash）、票据传递（pass-the-ticket）或构建黄金票据（Golden tickets）。 root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin DELPY...

nanorobeus

Nanorobeus Archivo COFF BOF para administrar tickets de Kerberos. Agentes compatibles Sliver Brute Ratel Cobalt Strike Comandos luid - obtener el ID de inicio de sesión actual sessions /luid: | /all - obtener sesiones de inicio de sesión klist /luid: | /all - listar tickets de Kerberos dump...

WonkaVision

WonkaVision WonkaVision es una herramienta de prueba de concepto POC para analizar tickets de Kerberos e intentar determinar si son falsificados. Esta herramienta fue creada por Charlie Clark y Andrew Schwartz. Cabe señalar que esta POC no está pensada para ser una aplicación empresarial lista pa...

mimikatz

mimikatz mimikatz es una herramienta que he creado para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocido por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

WCE

wce Wce es una excelente herramienta para la inyección de Hash; no solo sirve para la inyección de Hash, sino que también puede obtener directamente texto plano o Hash. Esta herramienta cuenta con versiones de 32 y 64 bits. ayuda Descripción de parámetros: root@kitploit: l 列出登录的会话和NTLM凭据（默认值）； s...

Astra Linux – Vulnerability in Samba

Kerberos acceptors need easy access to stable AD identifiers e.g., objectSid. Samba, as an AD DC, now provides a way for Linux applications to obtain a reliable SID and samAccountName from the issued tickets...

Astra Linux – Vulnerability in Samba

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on November 8, 2022, and according to RFC8429, it is assumed that RC4-HMAC is weak. Vulnerable Samba Active Directory Domain Controllers will issue RC4-HMAC encrypted tickets, even though the targe...

Weekly Metasploit Update: New Kerberos/Certificate tracing options, and multiple new modules

New Tracing Options As hard as we try to ensure that Metasploit is bug free, issues inevitably come up. Whether you’re running a module on an op or writing a new one, what we can do is make the debugging experience easier. To that end one of our two Google Summer of Code GSoC projects is here to...

rxrpc: reject undecryptable rxkad response tickets

...

Containing a domain compromise: How predictive shielding shut down lateral movement

In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001250 advisory. In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002903)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002903 advisory. In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the...

CLSA-2025-1761082525 Fix CVE(s): CVE-2022-45141

SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix session key selection algorithm for selecting the ticket in strongest-to-weakest order, thus allowing the target server to select better encryption - CVE-2022-45141...

SUSE CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

USN-7582-1: Samba vulnerabilities

Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. CVE-2022-3437 Greg Hudson discovered that Samba incorrectly handled PAC parsing. On...