o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

CompMgmtLauncher_DLL_UACBypass

CompMgmtLauncher 与 Sharepoint DLL 搜索顺序劫持：通过 OneDrive 实现 UAC 绕过/持久化 CompMgmtLauncher.exe 存在 DLL 搜索顺序劫持漏洞。当安装了 OneDrive 时，该二进制文件会在用户环境中搜索 Secur32.dll 或 Wininet.dll。在某些版本的 Windows 10 上，CompMgmtLauncher.exe 启用了自动提升功能。由于自动提升已启用，且 OneDrive 在 Windows 10 桌面版上默认安装，因此可以利用代理 DLL 执行代码。在 Windows 11 上，这为...

covert-control

covert-control Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py -...

M365Pwned

M365Pwned 用于通过 Microsoft Graph API 进行 Microsoft 365 攻击的红队工具。 两个 WinForms GUI 工具，用于使用应用程序级 OAuth 令牌枚举、搜索和从 M365 环境中窃取数据 — 无需用户交互。 工具| 目标| 功能 ---|---|--- MailPwned-GUI.ps1| Exchange Online / Outlook| 浏览邮箱、搜索邮件、下载附件、发送冒充邮件 SharePwned-GUI.ps1| SharePoint / OneDrive| 浏览站点和驱动器、搜索文件、预览和下载文档 ⚠️ 免责声明...

onedrive_user_enum

onedriveuserenum v2.10 有効なOneDriveユーザーを列挙する 列挙テクニックとOneDrive enumの詳細については、こちらのブログを参照してください: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ データベースを使用しない旧バージョンのOneDrive Enumをお探しなら、こちらにあります: https://github.com/nyxgeek/simplescanners 2.10の新機能: リモートMySQL DBログオプション -- リモートデータベースにログを記録...

SnaffPoint

SnaffPoint 它是什么 SnaffPoint 是一款为那些需要在这个世界上获得一些甜蜜的渗透测试人员打造的工具。它可以帮助你发现公司（或客户）的 SharePoint Online 和共享 OneDrive 文件中存在的敏感文件。 它是如何工作的 实际上有 2 个工具： GetBearerToken 将为你对 SharePoint 执行身份验证，带有常规 GUI 并支持 MFA SnaffPoint 仅限 CLI，它将自行执行枚举并找出有趣的文件 GetBearerToken 没什么特别的，按如下方式运行该工具： root@kitploit: GetBearerToken.exe...

KnockKnock

このリポジトリはアーカイブされました KnockKnockの最新バージョンを表示したり、問題を送信するには、https://github.com/waffl3ss/KnockKnock を参照してください。 KnockKnock - v0.9.9 必ずREADMEを活用してください。 OneDriveやMicrosoft Teamsへのクエリにより、潜在的なユーザー名を検証するために設計されています。これらは受動的な手法です。 Microsoft Teamsの列挙を通じて特定されたレガシーSkypeユーザーのリストを出力/作成できます。...

Microsoft OneDrive for MacOS < 26.095.0519.0003 Elevation of Privilege

The version of Microsoft OneDrive for MacOS installed on the remote macOS host is prior to 26.095.0519.0003. It is, therefore, affected by an elevation of privilege vulnerability: - Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to...

CVE-2026-65680

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

CVE-2026-65680

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

CVE-2026-65680

CVE-2026-65680 : Microsoft OneDrive for MacOS is affected by an Elevation of Privilege vulnerability. The issue arises from improper link resolution before file access (“link following”), allowing an authorized local attacker to escalate privileges. Affected component is OneDrive for MacOS; root ...

EUVD-2026-56826

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

...

CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

...

Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

PT-2026-70821

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502

Cloudreve prior to version 4.17.0 contains an OAuth scope bypass in the admin storage policy route POST /api/v4/admin/policy/oauth/signin. The admin route is under RequiredScopes(Admin.Read) and does not apply the local Admin.Write guard used by sibling policy mutation routes, allowing an attacke...

EUVD-2026-51394

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...