assless-chaps

assless-chaps Craquez rapidement des défis/réponses MSCHAPv2/NTLMv1 en utilisant une base de données de hachages NT Introduction Assless CHAPs est un moyen efficace de récupérer le hachage NT utilisé dans un échange MSCHAPv2/NTLMv1 si vous disposez du défi et de la réponse par exemple, à partir...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - исправленный форк Рабочий форк PoC-инструмента для CVE-2026-54121, также известного как Certighost. Оригинальное исследование и PoC от @H0j3n и @aniqfakhrul. Подробный анализ: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26. Этот форк исправляет обработк...

ShadowSpray

ShadowSpray Un outil pour pulvériser des Shadow Credentials à travers un domaine entier, dans l'espoir d'exploiter des DACLs GenericWrite/GenericAll oubliées depuis longtemps sur d'autres objets du domaine. Pourquoi cet outil Dans de nombreuses missions, je vois dans BloodHound que le groupe «...

CVE-2026-54121-CertiGhost

CVE-2026-54121-CertiGhost Этот POC — оригинальный код POC из https://github.com/aniqfakhrul/CVE-2026-54121/blob/main/certighost.py, но с небольшими изменениями: используется объект компьютера, которым мы уже управляем, вместо создания нового компьютера, который обычно ограничен через...

Exploit for Improper Authorization in Microsoft

certighost-oneclick CVE-2026-54121 Certighost – One-Click...

EUVD-2015-8643

Malware in sbrugna...

Exploit for CVE-2020-1472

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

CVE-1999-0366

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value...

DEBIAN-CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

Windows Local User Account Hash Carver

This module will change a local user's password directly in the registry. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Local User Account Hash Carver', 'Description...

DPAT - Domain Password Audit Tool for Pentesters

This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as oclHashcat.pot generated from the oclHashcat tool during password cracking. The report is an HTML report with clickable links. You can run the...

OS X Gather Mac OS X Password Hash Collector

This module dumps SHA-1, LM, NT, and SHA-512 Hashes on OSX. Supports versions 10.3 to 10.14. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'OS X Gather Mac OS X Passwo...

3proxy user account locking

It's possible to lock user's account if user's password is stored as NT-hash via HTTP proxy. Service restart or configuration reload is required to restore account in working state. In addition, Basic authentication is offered as first authentication protocol, it can lead to shoosing weak clearte...

CVE-1999-0366

CVE-1999-0366 concerns Windows NT 4.0 SP4. Affected component: network shares authentication; root cause: null NT hash value enables access with a blank password. Impact stated as PARTIAL confidentiality, integrity, and availability. Exploitation details are not provided in the connected document...

CVE-1999-0366: Improper Authentication

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value...