impostor

Impostor Servidor SMB1 para interceptar hashes NTLMv2, escrito en C. El objetivo del proyecto es implementar un servidor SMB1 como una máquina de estados que acepte y responda correctamente a las solicitudes del cliente para engañarlo, llevándolo a completar una autenticación NTLM y así revelar s...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook 漏洞利用 CVE-2023-23397 是 Microsoft Outlook 中的一个漏洞，允许攻击者可能窃取用户的身份验证详细信息。该漏洞源于攻击者能够在电子邮件或会议邀请中的 "ReminderSoundFile" 属性中指定一个通用命名约定 UNC 路径。当 Outlook 中的提醒触发时，用户的客户端会尝试加载路径中指定的声音文件。如果 Outlook 发起与远程 SMB 服务器的 SMB 连接，攻击者可能拦截用户的 Net-NTLMv2 哈希，并利用该哈希进行中继，从而以该用户身份进行身份验证。 本 GitHub...

CVE-2025-24054

Windows 文件资源管理器零点击 NTLMv2-SSP 哈希泄露 🎥 演示 POC + 2025年3月补丁绕过 🎥 补丁绕过 点击上方图片观看漏洞演示 📋 技术概述 本仓库提供了一个全面的研究框架，分析了 Windows Shell 文件格式处理中导致 NTLMv2-SSP 凭据泄露的漏洞链。该工具包实现了两种不同的攻击向量，利用 Windows 资源管理器在文件预览操作期间自动解析 UNC 路径的特性。 核心漏洞机制 根本安全问题在于 Windows Shell 在预览操作期间自动处理特定文件格式中嵌入的 UNC 路径。当用户打开包含特制文件的 ZIP 存档时，Windows...

CVE-2023-23397

CVE-2023-23397 漏洞利用与缓解演示 📌 概述 本项目演示了 CVE-2023-23397 的检测、利用与缓解，这是 Microsoft Outlook for Windows 中的一个严重零点击 NTLM 中继漏洞。通过日历邀请进行利用，攻击者能够在无需任何用户交互 的情况下捕获 NTLMv2 哈希。 🛡️ CVSS 评分： 9.8（严重） 🖥️ 受影响版本： Outlook 2013、2016、2019、Microsoft 365（2023 年 3 月 14 日补丁之前） ⚠️ 漏洞详情 Outlook 的日历提醒可通过 PidLidReminderFileParameter...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Cobalt Strike Aggressor 脚本 一个全面的 Cobalt Strike Aggressor 脚本，用于武器化并执行恶意 LNK 文件和 Library-MS 文件，以泄露 SMB NTLMv2-SSP 哈希。包含 CVE-2025-24054 绕过技术。 ⚠️ 免责声明 此工具仅用于教育和研究目的。作者对任何滥用此代码的行为不承担任何责任。仅在你拥有或明确获准测试的系统上使用。 捕获 NTLM 哈希 该脚本生成武器化的 .lnk 和 .library-ms 文件，当打开时会触发向操作者主机的 SMB 身份验证。 泄露的 NTLMv2...

CVE-2026-32202

Zero-click強制認証: 細工された .lnk が含まれるフォルダを表示すると、アイコンのレンダリング時にUNC解決がトリガーされ、被害者は攻撃者が指定したアウトバウンド接続を強制され、Net-NTLMv2資格情報が漏洩しリレーも可能になる。これはCVE-2026-21510の不完全な修正により発生した。Microsoftが追加した信頼性検証はShellExecuteExW呼び出し時起動時のみ機能したが、CControlPanelFolder::GetUIObjectOfの時点では既に被害が発生しており、これはShellExecuteの信頼性検証より前に呼び出される。...

EUVD-2026-51330

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

Linux Distros Unpatched Vulnerability : CVE-2026-64389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2...

OpenVPN 2.6.0 < 2.6.21 / 2.7.x < 2.7.5 Multiple Vulnerabilities

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by multiple vulnerabilities: - A use-after-free bug in ackwritebuf, triggerable by a well-timed sequence of control channel and authentication packets. CVE-2026-12996 - A...

openvpn -- multiple vulnerabilities

The OpenVPN community project team reports: ... OpenVPN 2.7.5 ... is a bugfix release fixing several security issues: Fix use-after-free bug in ackwritebuf, triggerable by a well-timed sequence of control channel + authentication packets CVE-2026-12996 Fix use-after-free bug in tlswrapreneg,...

CVE-2026-53632

A flaw was found in launch-editor. This component, used in Node.js to open files, can be tricked into accessing arbitrary paths, including Windows Universal Naming Convention UNC paths. When a malicious UNC path is opened, Windows automatically attempts NTLM authentication to a remote server...

CVE-2026-53632 NTLMv2 hash disclosure via UNC path handling on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vulnerability discovered by ? in WordPress Npm vite versions = 6.4.2...

External Control of File Name or Path

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to External Control of File Name or Path in the handling of UNC paths on Windows systems. An attacker can obtain NTLMv2 password hashes by tricking a user into accessing a malicious SMB server...

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...

GHSA-V6WH-96G9-6WX3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Summary The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result ...