PetitPotam

PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...

ridrelay

RidRelay 内部ネットワーク上でドメインユーザー名を迅速かつ簡単に取得する方法。 連絡先: @skorov8 仕組み RidRelayは、NTLMリレー攻撃、一般的なlsarpcベースのクエリ、RIDサイクリングを組み合わせて、ドメインユーザー名のリストを取得します。以下の手順を実行します： 1. SMBサーバとHTTPサーバを起動し、着信接続を待つ 2. 着信した資格情報を指定されたターゲットにリレーし、リレーされたユーザーのコンテキストで接続を作成する 3. SMB接続を介してlsarpcパイプにクエリを送信し、ドメインユーザー名のリストを取得する。これは最大50000...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

Canonical ksmbd-tools LSARPC Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canonical ksmbd-tools. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the LSARPCOPNUMLOOKUPSID2 opcode. The issue results from the lac...

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Microsoft Windows Local Security Authority LSA contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM...

Microsoft Windows Secondary Logon Denial of Service (MS16-046: CVE-2016-0135)

A remote denial of service vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way Windows handles memory blocks while using the LSARPC protocol. A remote attacker can exploit this issue by enticing the victim to open a specially crafted file...

Denial of service

srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via an SMB WRITEANDX packet with an offset that is...

Microsoft Windows WRITE_ANDX SMB command handling Kernel DoS

Some days ago i have discovered a DoS in Windows Vista. Here is the advisory with a detailed description about the vulnerability that will help to Microsoft they have been already notified about the bug to correct it as soon as possible, and it will help you if you need to add any rule for your...