ItWasAllADream

Era tutto un sogno Un CVE-2021-34527 aka PrintNightmare scanner Python. Ti permette di scansionare intere sottoreti per il PrintNightmare RCE non il LPE e genera un report CSV con i risultati. Verifica la sfruttabilità tramite MS-PAR e MS-RPRN. Questo strumento ha versioni "disarmate" degli explo...

CVE-2021-34527

PrintNightmare CVE-2021-34527 Questa versione dell'exploit PrintNightmare è basata sul codice creato da Cube0x0, con le seguenti caratteristiche: Capacità di colpire più host. Server SMB integrato per la consegna del payload, eliminando la necessità di condivisioni file aperte. L'exploit include...

PrintNightmare

PrintNightmare Implementazione Python per PrintNightmare CVE-2021-1675 / CVE-2021-34527 utilizzando Impacket standard. Installazione root@kitploit: $ pip3 install impacket Utilizzo root@kitploit: Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: printnightmare.py -h -debug -port...

CoercedPotatoRDLL

Coerced Potato Reflective DLL Elevazione dei privilegi da NT Service a SYSTEM sfruttando il privilegio SeImpersonateToken e le funzioni MS-RPRN. Fortemente basato su https://github.com/Prepouce/CoercedPotato Reflective Loader da https://github.com/stephenfewer/ReflectiveDLLInjection. Installazion...

Zero-day-scanning

zeroscan Zeroscan 是一个域控制器漏洞扫描器，当前包含针对 Zerologon CVE-2020-1472、MS-PAR/MS-RPRN 和 SMBv2 签名的检查。 CVE-2020-1472： 使用内置脚本检查 Zerologon CVE-2020-1472，但不会尝试利用目标，它只是一个漏洞扫描器。代码来源于：https://github.com/Anonymous-Family/CVE-2020-1472.git MS-PAR / MS-RPRN： 使用 Impacket 的 rpcdump 的包装器来检查打印服务 MS-PAR 和 MS-RPRN...

zeroscan

zeroscan Zeroscan ist ein Schwachstellenscanner für Domain Controller, der derzeit Prüfungen für Zerologon CVE-2020-1472, MS-PAR/MS-RPRN und SMBv2-Signierung umfasst. CVE-2020-1472: Verwendet ein eingebautes Skript, um auf Zerologon CVE-2020-1472 zu prüfen, versucht aber NICHT, das Ziel auszunutz...

Exploit for CVE-2021-34527

PrintNightmare CVE-2021-34527 This version of the PrintNigh...

MultiPotato - Another Potato to get SYSTEM via SeImpersonate privileges

First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the code can be...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...