60 matches found
CVE-2023-23397
CVE-2023-23397 Simple and dirty PoC of the CVE-2023-23397 vulnerability impacting the Outlook thick client. Description Outlook suffers from a lack of control over the user input that allows to configure the sound of a meeting and appointment reminder. Indeed, an attacker is able to force a victi...
CVE-2025-24071_PoC
CVE-2025-24071 / CVE-2025-24054 PoC Edit: MICROSOFT HAS BEEN RENAMED CVE-2025-24071 AS CVE-2025-24054 🤔 Overview This Windows vulnerability, specifically in 'explorer.exe', allows us to receive a NetNTLMv2 hash from a victim simply by having the attacker extract a .zip file. Usage Execute the...
HashSiphon
HashSiphon NTLM hash extraction through HTTP-layer authentication proxying, zero SSPI calls from the attacker process. HashSiphon extracts the current user's NetNTLMv2 hash by manipulating HTTP authentication flows instead of calling SSPI APIs directly. It ships two variants: v1 routes NTLM auth...
Moniker-Link-Lab-Setup
Part of my SOC Analyst portfolio https://github.com/E-m-e-k-a/SOC-Analyst-Portfolio Moniker Link Lab Setup - CVE-2024-21413 🎯 Project Overview Hands-on penetration testing lab demonstrating CVE-2024-21413 moniker link exploitation for NTLM credential theft. This project documents the complete...
icebreaker
icebreaker Break the ice with that cute Active Directory environment over there. When you're cold and alone staring in at an Active Directory party but don't possess even a single AD credential to join the fun, this tool's for you. Sequentially automates 5 internal network attacks against Active...
CVE-2025-24071
CVE-2025-24071 This Python script is designed to demonstrate the CVE-2025-24071 vulnerability in Windows Explorer. This vulnerability allows an attacker to capture netNTLMv2 credentials from a victim without any direct interaction from the victim. Description The CVE-2025-24071 vulnerability exis...
hashmuncher
Hash Muncher Grab NetNTLMv2 hashes using ETW with administrative rights on Windows Requires elevated administrator access on Windows 8.1 / Windows 2016 or later Uses Event Tracing for Windows ETW to get access to raw packet data for SMB authentication packets Decodes NTLM message types 2 and 3...
lab-SMB-responder-CVE-2024-21413
SMB Lab + Responder CVE-2024-21413 🎯 Objective This project aimed to study the CVE-2024-21413 MonikerLink vulnerability, exploring how the SMB/NTLM protocol can be abused for credential capture. Even after the official Microsoft patch, the lab shows that the concept remains valid in internal...
Get-NetNTLM
Get-NetNTLM Powershell module to get the NetNTLMv2 hash of the current user Example Usage: PS C: Get-NetNTLM-Hash Administrator::desktop:1122334455667788:4FFFB35....F18337AB10:0101000000000000BD526...4006F0072006D000000000000000000...
CVE-2024-21413-Microsoft-Outlook-Moniker-Link-Vulnerability
CVE-2024-21413 – Microsoft Outlook Moniker Link Vulnerability Overview This repository documents my hands-on analysis of CVE-2024-21413 Moniker Link , a critical Microsoft Outlook vulnerability that bypasses Protected View to leak Windows NetNTLMv2 credentials via SMB authentication. Severity:...
CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook versions including Microsoft 365 Apps, Outlook 2016/2019, Office LTSC 2021 before February 2024 patch. It allows an unauthenticated attacker to bypass Outlook’s Protected View by sending a specially crafted emai...
cve-2024-21413-outlook-monikerlink-lab
CVE-2024-21413 — Outlook Moniker Link Lab / PoC Educational lab notes and a small Proof of Concept PoC demonstrating the CVE-2024-21413 attack flow in a controlled environment TryHackMe-style lab. ⚠️ For educational purposes only. Do not use against systems you don’t own or have explicit permissio...
CVE-2024-21413-Outlook-Assessment
title: "CVE-2024-21413 Moniker Link: Microsoft Outlook Remote Code Execution Assessment" date: 2026-06-28 author: Lindon Mitchell YoguiCR role: Security Researcher / Exploit Analyst status: Completed classification: Public / Portfolio environment: TryHackMe - Moniker Link Lab Vulnerability...
Email-exploit-Moniker-Link-CVE-2024-21413-
Email exploit Moniker Link-CVE-2024-21413-Module — Documentation Overview: A practical PoC demonstrating the use of a Moniker Link in an HTML email to trigger an SMB connection from Outlook, allowing capture of a victim's netNTLMv2 hash via Responder. This showcases practical skills in penetratio...
CVE-2026-76654
A flaw was found in Kubernetes kubelet on Windows nodes. When kubelet resolves a volume subPath that is a symbolic link, it does not reject an ordinary UNC network path. Following that link causes Windows to authenticate to the remote share with NTLM, exposing the NetNTLMv2 hash of the kubelet...
PoC-CVE-2025-24071
❀ coerce-library CVE-2025-24071 — coerción NTLM mediante .library-ms método SMB / TAR ❀ Qué hace Solicita tu IP de ataque y un nombre de archivo , escribe un .library-ms apuntando a \\share, y lo empaqueta en exploit.tar. Cuando el Explorador examina la carpeta donde acaba el .library-ms suelto,...
Microsoft - NTLMv2 Hash Capture
Titles: Microsoft - NTLMv2 Hash Capture Author: nu11secur1ty Date: 2026-05-27 Vendor: Microsoft Software: Windows Shell File Explorer Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32202 Description: A spoofing vulnerability in Windows Shell File Explorer allows an attacker to capture NTLMv...
EUVD-2017-6447
Malware in sbrugna...