DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as...

PrivExchange

PrivExchange POC tools accompanying the blog Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket, but it is recommended to use the latest version from GitHub. privexchange.py This tool simply logs ...

DragonCastle

DragonCastle A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a DLL to the target machine. Then it enables remote registry to modify AutodialDLL entry and start/restart BITS service. Svchosts would load our DLL, set...

NimExec

NimExec Basically, NimExec is a fileless remote command execution tool that uses The Service Control Manager Remote Protocol MS-SCMR. It changes the binary path of a random or given service run by LocalSystem to execute the given command on the target and restores it later via hand-crafted RPC...

SharpSCCM

Tool Overview SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager a.k.a. ConfigMgr, formerly SCCM for lateral movement and credential gathering without requiring access to the SCCM administration console GUI. SharpSCCM was initially created to execu...

SharpWebServer

SharpWebServer A Red Team oriented simple HTTP & WebDAV server written in C with functionality to capture Net-NTLM hashes. To be used for serving payloads on compromised machines for lateral movement purposes. Requires .NET Framework 4.5 and System.Net and System.Net.Sockets references. Usage ::...

CVE-2022-30216

CVE-2022-30216 حزمة Zeek تُصدر إشعارات بشأن محاولات ونجاحات استغلال CVE-2022-30216، وهي تقنية تُستخدم ضد Windows Server لإجبار تفويض NTLM إلى خادم عشوائي. يمكن للمهاجم إعادة استخدام رمز NTLM لتوليد شهادة عميل، مما يتيح له طلب تذكرة Kerberos تمنحه الوصول إلى وحدة تحكم المجال. التثبيت $ zkg install...

NTLMRecon

Overview NTLMRecon is a Golang version of the original NTLMRecon utility written by Sachin Kamath AKA pwnfoo. NTLMRecon can be leveraged to perform brute forcing against a targeted webserver to identify common application endpoints supporting NTLM authentication. This includes endpoints such as t...

MSSqlPwner

MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM Hashes, and kerberos tickets. With MSSqlPwner, users can...

spraykatz

Spraykatz Spray love around the world Index Title| Description ---|--- About| Brief Description about the tool Installation| Installation and Requirements Usage| How to use Spraykatz Changelog| Spraykatz changelog Acknowlegments| Acknowlegments About Spraykatz is a tool without any pretention abl...

Potato

Potato Élévation de privilèges sur Windows 7, 8, 10, Server 2008, Server 2012 Comment ça fonctionne Potato exploite des problèmes connus dans Windows pour obtenir une élévation de privilèges locale, à savoir le relais NTLM plus précisément le relais HTTP-SMB et l'usurpation NBNS. En utilisant les...

vss-fr2system

vss-fr2system أداتان صغيرتان تحوّلان ثغرة قراءة ملفات تعسفية على ويندوز إلى شل SYSTEM. vssfreeze/ — يُنشئ نسخة ظل وحدة تخزين Volume Shadow Copy كمستخدم قياسي ، ثم يُبقيها مفتوحة لتمنحك وقتًا لقراءة خلايا SAM/SECURITY/SYSTEM منها fr2system/ — يأخذ الخلايا التي نسختها، يفك تشفير تجزئات NTLM المحلية...

printerbugnew

Déclencheur de spouleur d'impression RPC pur sur TCP Pour Windows 11 22H2+ / Windows Server 2025 Utilisation printerbugnew.py username password domain attackerhost tcpport Exemples Connexion anonyme printerbugnew.py 192.168.1.100 Avec identifiants printerbugnew.py 192.168.1.100 admin Password123...

weaponized-0604

أداة استغلال مُسلّحة لـ CVE-2019-0604 أداة استغلال آلية لتعظيم استغلال CVE-2019-0604. المتطلبات ملف requirements.txt يجب أن يسرد جميع مكتبات بايثون التي تستخدمها هذه الأداة، وسيتم تثبيتها باستخدام $ pip install -r requirements.txt الاستغلال الأعمى اليدوي مع أو بدون بيانات اعتماد $ python exploit....

CVE-2025-33073

CVE-2025-33073 : PoC de relais par réflexion Outil d'exploitation universel pour CVE-2025-33073 ciblant les contrôleurs de domaine Windows avec privilèges DNSAdmins et WinRM activé. 📋 Aperçu CVE-2025-33073 est une vulnérabilité critique qui permet aux attaquants d'obtenir une exécution de code au...

Domain-Controller-DC-Exploitation-with-Metasploit-Impacket

استغلال وحدة تحكم المجال DC باستخدام Metasploit و Impacket استغلال شامل لوحدة تحكم المجال من البداية إلى النهاية باستخدام Metasploit و Impacket: اكتشاف DC10، واستغلال ثغرة Zerologon CVE-2020-1472، واستخراج تجزئات NTLM، والحصول على شل SYSTEM، وإنشاء جلسة Meterpreter. الملخص التنفيذي يوضح هذا التمر...

CVE-2025-33073

CVE-2025-33073 إثبات المفهوم PoC لاستغلال ثغرة انعكاس NTLM في بروتوكول SMB. جميع الشكر للبحث الرسمي: https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 المتطلبات الأساسية نظام التشغيل: Kali Linux لديه معظم الحزم مثبتة مسبقً...