2881 matches found
NtlmRelayToEWS
ntlmRelayToEWS Author: Arno0x0x - @Arno0x0x ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the...
smartbrute
Description The smart password spraying and bruteforcing tool for Active Directory Domain Services. β οΈ This project works. But the filthy coding makes it more PoC than a stable tool. I may or may not rewrite this in the future, but at least you have everything here to work with bruteforce on any...
ldapdomaindump
LDAPDomainDump Volcador de informaciΓ³n de Active Directory a travΓ©s de LDAP IntroducciΓ³n En un dominio de Active Directory, cualquier usuario autenticado o mΓ‘quina puede recuperar mucha informaciΓ³n interesante a travΓ©s de LDAP. Esto convierte a LDAP en un protocolo interesante para recopilar...
SharpMapExec
SharpMapExec A sharpen version of CrackMapExec. This tool is made to simplify penetration testing of networks and to create a swiss army knife that is made for running on Windows which is often a requirement during insider threat simulation engagements. Besides scanning for access it can be used ...
DavRelayUp
DavRelayUp Un port rΓ‘pido y sucio de KrbRelayUp con modificaciones para permitir el relay NTLM desde webdav a LDAP con el fin de simplificar el abuso de la siguiente primitiva de ataque: 0. Opcional CreaciΓ³n de una nueva cuenta de mΓ‘quina New-MachineAccount 1. Forzar el inicio del servicio...
aclpwn.py
aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...
CVE-2024-21413-Vulnerabilidad-Outlook-LAB
CVE-2024-21413 β Outlook LAB Vulnerability Vulnerability Description CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to...
Internal-Monologue
Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as...
CVE-2026-33829-Writeup
CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...
ranger
ranger Una herramienta para ayudar a los profesionales de seguridad a acceder e interactuar con sistemas remotos basados en Microsoft Windows. Este proyecto fue conceptualizado con el pensamiento de que no inventamos el arco ni la flecha, solo una forma mΓ‘s eficiente de usarlos. Ranger es una...
weaponized-0604
Weaponized CVE-2019-0604 Automated Exploit Tool to Maximize CVE-2019-0604. Requirement The requirements.txt file should list all Python libraries this tool used, and they'll be installed using root@kitploit: $ pip install -r requirements.txt Manual blind exploit without credential root@kitploit: ...
ridrelay
RidRelay Forma rΓ‘pida y sencilla de obtener nombres de usuario del dominio mientras estΓ‘s en una red interna. ContΓ‘ctame: @skorov8 CΓ³mo funciona RidRelay combina el ataque de retransmisiΓ³n NTLM, consultas comunes basadas en lsarpc y el ciclo de RID para obtener una lista de nombres de usuario del...
ACEDcup
ACEDcup ACEDcup tool is a payload generator for Java Binary Deserialization attack ACED For Apache Commons FileUpload ver = 1.3 CVE-2013-2186 and Oracle JDK ver 7u40 The attack works even for newer versions of the lib or Java. We can upload any content in any directory, but we cannot control a fi...
CVE-2025-24071_PoC
CVE-2025-24071PoC CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute...
DragonCastle
DragonCastle A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a DLL to the target machine. Then it enables remote registry to modify AutodialDLL entry and start/restart BITS service. Svchosts would load our DLL, set...
nosferatu
nosferatu Backdoor de autenticaciΓ³n NTLM/Kerberos de Windows CΓ³mo funciona Primero, la DLL se inyecta en el proceso lsass.exe y comenzarΓ‘ a interceptar llamadas de autenticaciΓ³n de la API de Windows. Las funciones objetivo son: NTLM: NtlmShared!MsvpPasswordValidate Kerberos:...
CVE-2025-24071-POC-NTLMHashDisclosure-
CVE-2025-24071-POC-NTLMHashDisclosure Triggers automatic SMB authentication to an attacker-controlled share. No interaction required β Windows Explorer initiates this NTLM authentication automatically. Results in NTLMv2 hash leakage information disclosure. Affects Windows 10/11 all versions,...
Domain-Controller-DC-Exploitation-with-Metasploit-Impacket
Domain-Controller-DC-Exploitation-with-Metasploit-Impacket End-to-end Domain Controller exploitation using Metasploit and Impacket: discovered DC10, exploited Zerologon CVE-2020-1472, extracted NTLM hashes, gained SYSTEM shell, and established a Meterpreter session. Executive Summary This exercis...
dc-sonar
DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid using it on the production Active Directory AD domain. Neither contributor incur any responsibilit...
CVE-2022-30216
CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...