10 matches found
PetitPotam
PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...
ridrelay
RidRelay Forma rápida y sencilla de obtener nombres de usuario del dominio mientras estás en una red interna. Contáctame: @skorov8 Cómo funciona RidRelay combina el ataque de retransmisión NTLM, consultas comunes basadas en lsarpc y el ciclo de RID para obtener una lista de nombres de usuario del...
ridrelay
RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...
adnullenum
adnullenum A single-pass Active Directory enumerator for an anonymous null session, using the \samr and \lsarpc named pipes. No credentials required. It doesn't do anything the classic tools can't. What it does is gather it all in one run and lay the results out cleanly. On an engagement you land...
Canonical ksmbd-tools LSARPC Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canonical ksmbd-tools. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the LSARPCOPNUMLOOKUPSID2 opcode. The issue results from the lac...
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Microsoft Windows Local Security Authority LSA contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM...
Microsoft Windows Secondary Logon Denial of Service (MS16-046: CVE-2016-0135)
A remote denial of service vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way Windows handles memory blocks while using the LSARPC protocol. A remote attacker can exploit this issue by enticing the victim to open a specially crafted file...
Denial of service
srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via an SMB WRITEANDX packet with an offset that is...
Microsoft Windows WRITE_ANDX SMB command handling Kernel DoS
Some days ago i have discovered a DoS in Windows Vista. Here is the advisory with a detailed description about the vulnerability that will help to Microsoft they have been already notified about the bug to correct it as soon as possible, and it will help you if you need to add any rule for your...
