CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor Script A comprehensive Cobalt Strike Aggressor script that weaponizes and executes malicious LNK files and Library-MS files for SMB NTLMv2-SSP hash disclosure. Includes CVE-2025-24054 bypass techniques. ⚠️ DISCLAIMER This tool is for educational and researc...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2025-24054

Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure 🎥 Demonstration POC + March 2025 Patch bypass 🎥 patch bypass Click the image above to watch the vulnerability demonstration 📋 Technical Overview This repository provides a comprehensive research framework analyzing the vulnerability chai...

EUVD-2025-6243

Malicious code in bioql PyPI...

EUVD-2022-48102

Malicious code in bioql PyPI...

CVE-2022-45194

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

CVE-2025-1887

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker...

CVE-2025-1887

CVE-2025-1887 concerns an SMB forced authentication vulnerability in Sage 200 Spain, affected in versions prior to 2025.35.000. An authenticated attacker with administrator privileges can obtain an NTLMv2-SSP hash by redirecting a UNC path to a server under the attacker’s control. The root cause ...

CVE-2025-1887 SMB forced authentication vulnerability in Sage 200 Spain

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker...

CVE-2025-1887 SMB forced authentication vulnerability in Sage 200 Spain

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker...

PT-2025-10085

Name of the Vulnerable Software and Affected Versions Sage 200 Spain versions prior to 2025.35.000 Description The issue allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the...

CVE-2025-1887: Authentication Bypass by Capture-replay

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker...

CVE-2022-45194

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

Design/Logic Flaw

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

CVE-2022-45194

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

CVE-2022-45194

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

CVE-2022-45194: Improper Restriction of XML External Entity Reference

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...

Metasploit Weekly Wrap-Up

Mucking out the pipes. Thanks to some quick work by timwr, CVE-2022-0847 aka "Dirty Pipe" gives Metasploit a bit of digital plumber's training. The exploit targeting modern Linux v5 kernels helps elevate user privileges by overwriting a SUID binary of your choice by plunging some payload gold...