14196 matches found
CVE-2020-9495
CVE-2020-9495 PoC CVE-2020-9495 is medium severity LDAP injection vulnerability in Apache Archiva versions before 2.2.5. It allows an attacker to retrieve any LDAP attribute values of users that exist on the LDAP server. From the official Apache Archiva advisory: By providing special values to th...
ldapdomaindump
LDAPDomainDump Active Directory information dumper via LDAP Introduction In an Active Directory domain, a lot of interesting information can be retrieved via LDAP by any authenticated user or machine. This makes LDAP an interesting protocol for gathering information in the recon phase of a pentes...
ldapnomnom
LDAP Nom Nom Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by abusing LDAP Ping requests cLDAP Looks for enabled normal user accounts. No Windows audit logs generated. High speed up to 50K/sec per server - go way beyond that with multiple...
CVE-2024-49112-PoC
CVE-2024-49112-PoC CVE-2024-49112 LDAP RCE PoC and Metasploit Module Edit: links updated last 3 copies to go Link to Download: Contact Information You can reach me at: [email protected] please dont ask me if I can provide this for free, or if I can test your target, or how to add the module ...
CVE-2021-44228
Log4Shell POC CVE-2021-44228 The scope of this repository is to provide all the components needed to exploit CVE-2021-44228, nicknamed Log4Shell, and to show how to exploit it. The ingredients needed to exploit this vulnerability are the following: 1. An LDAP Server that will redirect the...
adfly
adfly active directory query tool using LDAP Protocol , helps red teamer / penetration testers to validate users credentials , retrieve information about AD users , AD groups AD fly is Tool uses LDAP Protocol for users authentication access and queries of information ,since AD fly uses LDAP for...
CVE-2024-21006_jar
CVE-2024-21006jar Exploit code reference: https://github.com/momika233/CVE-2024-21006 Here, the source code has been compiled into a JAR package for ease of use. The lib directory contains dependency files. If you wish to modify the source code, you can compile it yourself. Usage java -jar...
lempo
Lempo: LDAP Exposure on POrtainer CVE-2018-19466 | Mauro Eldritch AKA plaguedoktor ./lempo.rb TARGETIP TARGETUSER TARGETPASSWORD This exploit is a complement to my talk Hacking Docker with PAZUZU. Presentations | Date| Conference| Link to Video| Link to Slides ---|---|---|---|--- 1| NOV-2018|...
jndi-ldap-test-server
jndi-ldap-test-server This is a minimalistic LDAP server that is meant for test vulnerability to JNDI+LDAP injection attacks in Java, especially CVE-2021-44228. How to test vulnerability to CVE-2021-44228 1. Download the test server binary for your platform you can find all binaries under Release...
freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
Critical: Red Hat Security Advisory: ipa security, bug fix, and enhancement update
An update for ipa is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...
ldap_shell
LDAP shell This project is a fork of ldapshell from Impacket. It provides an interactive shell for Active Directory enumeration and manipulation via LDAP/LDAPS protocols, making it useful for both system administrators and security professionals. Installation These tools are only compatible with...
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...
Critical: Red Hat Security Advisory: ipa security update
An update for ipa is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...