CVE-2023-35636

CVE-2023-35636 Microsoft Outlook Information Disclosure Vulnerability leak password hash - Expect Script POC CVE-2023-35636 an exploit of the calendar sharing function in Microsoft Outlook, whereby adding two headers to an email directs Outlook to share content and contact a designated machine...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

CVE-2026-109430

Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XML External Entity (XXE) injection because the /WebAdvisor/WebAdvisor endpoint fails to disable external entity and DTD resolution. A remote attacker can submit crafted XML POST requests to trigger Server-Side Request Forgery (SSRF) , d...

EUVD-2026-101808

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

NTLMRawUnHide

NTLMRawUnhide.py Author : Mike Gualtieri Blog : https://www.mike-gualtieri.com Twitter : https://twitter.com/mlgualtieri GitHub : https://github.com/mlgualtieri/NTLMRawUnhide Write up: https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol Intro NTLMRawUnhide.py is ...

impostor

Impostor SMB1 server for intercepting NTLMv2 Hashes, written in C. The goal of the project is to implement an SMB1 server as a state machine that correctly accepts and responds to client requests in order to deceive it, leading it to complete an NTLM authentication and thus reveal its own NTLMv2...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...

monikerlink-cve-2024-21413-writeup

Moniker Link CVE-2024-21413 Writeup Writeup from TryHackMe's Moniker Link room: exploiting CVE-2024-21413 to bypass Outlook's Protected View and capture a victim's NTLMv2 hash via a crafted Moniker Link. Part of my ongoing OSCP-prep practice. Contents monikerlink-cve-2024-21413-writeup.md: the...

CVE-2024-43451-POC

Descripción Nombre : CVE-2024-43451 Puntuación CVSSv3 : 6.5 Versiones afectadas : Todas las versiones de Microsoft Windows anteriores al parche de noviembre de 2024 CVE-2024-43451 es una vulnerabilidad de día cero en Microsoft Windows que permite a los atacantes capturar hashes de contraseñas...

CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...

CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC

💻 CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC 🧩 Overview This project reproduces the MonikerLink behavior CVE-2024-21413 in a fully isolated TryHackMe environment to show how certain hyperlink formats can cause Outlook to process a link in a way that leaks...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full walkthrough of TryHackMe's "Moniker Link" room: weaponizing CVE-2024-21413, a 2024 Microsoft Outlook vulnerability, to steal a victim's NTLMv2 hash the moment they click a link in a phishing email — no macro, no attachment, no obvious...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

CVE-2025-24071 — Windows File Explorer Spoofing / NTLM Hash Di...

CVE-2026-53632: External Control of File Name or Path

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vulnerability discovered by ? in WordPress Npm vite versions = 6.4.2...

GHSA-V6WH-96G9-6WX3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...

CVE-2026-39908

OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application...

CVE-2026-39908

OpenBullet2 ≤ v0.3.2 on Windows suffers a credential disclosure via a UNC-path proxy source. When a job loads proxies from an attacker-controlled UNC path, an SMB authentication occurs and reveals the NTLMv2 hash of the process user, enabling relay or offline cracking. Affected component is the p...