CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

noPac

noPac CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. Yet another low effort domain user to domain admin exploit. If a Domain Controller is vulnerable it will return a TGT without a PAC, all eyes on small size tickets. Mitigation Patch your Domain Controllers! Credits Charlie Clark for his...

pacpoc

PACPoC: A local PoC exploit for CVE-2019-2205 To try out this exploit install the "malicious" app PacTest.apk and make exploit.pac available over http with, for example python -m SimpleHTTPServer. Then go to proxy settings on an Android device, select proxy autoconfig, and enter the URL to...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 iOS 26.1에서의 WebKit/ANGLE 체인에 대한 메모와 PoC 자료입니다. 완전한 익스플로잇이 아니며, 검증된 프리미티브와 아직 실패하는 부분을 분리하여 정리했습니다. 작성자: zeroxjf 기반: jir4vv1t의 CVE-2025-43529 익스플로잇 상태: 부분 체인; 임의 R/W 미검증 테스트 기기: iPhone 11 Pro Max, iOS 26.1 최종 업데이트: 2026년 1월 범위 및 크레딧...

bbs

BBS 이전 bbs는 여기에서 찾을 수 있습니다. 설명 bbs는 SOCKS 및 HTTP 프록시용 라우터입니다. SOCKS5, HTTP CONNECT 또는 포트 포워딩 서비스를 노출하고, 요청 대상에 따라 수신 요청을 프록시 또는 프록시 체인으로 전달합니다. 라우팅은 PAC 지원으로 빌드한 경우 PAC 스크립트 또는 JSON 파일을 통해 구성할 수 있습니다. 설치 go install github.com/synacktiv/bbs@master PAC 스크립트 지원으로 bbs를 설치하려면: go install -tags pac...

noPac-detection

About Detection script for CVE-2021-42278 and CVE-2021-42287 Usage The detection script uses the domain account credentials to determine the possibility of the vulnerabilities. usage: noPac-detection.py -h -debug -dc-ip -targetUser credentials optional arguments: -h, --help show this help message...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Microsoft Windows Kerberos 인증 우회 CVSS 점수: 9.8치명적 상태: 실제 환경에서 활발한 악용 중 공개: Microsoft 2025년 8월 패치 화요일제로데이 개요 CVE-2025-53779는 Microsoft Windows Kerberos 프로토콜 구현에서 발생하는 치명적인 인증 우회 취약점입니다. 인증되지 않은 공격자는 유효한 자격 증명이나 암호화 자료를 보유하지 않고도 이 결함을 악용하여 Kerberos 인증을 완전히 우회하고 도메인 관리자를 포함한 모든 도메인 사용...

CVE-2026-65330

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...

NoPacScan

NoPacScan NoPacScanはCVE-2021-42287/CVE-2021-42278のスキャナーです。元のスクリプトよりも多くのドメインコントローラーをスキャンでき、より正確です。DNS検索msdcs.aaa.comを使用してDCをスキャンします。これはLDAPやSAMRよりも優れており、見つけたすべてのDCを自動的にスキャンします。LDAPやSAMRを使用すると、プライマリDCから削除された一部のDCを見逃す可能性があります。より正確にするために、この脆弱性に対するマイクロソフトの主要なパッチであるタイプ0x10のPACをスキャンします。...

CLEANSTART-2024-AC14298 PAC parsing in MIT Kerberos 5 (aka krb5) before 1

CVE-2022-42898 affects multiple packages. PAC parsing in MIT Kerberos 5 aka krb5 before 1. See references for individual vulnerability details...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc (crlsa-2021_5142)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20215142 advisory. samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets CVE-2020-25719 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-libs-debuginfo / krb5-pkinit / etc (crlsa-2022_8637)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228637 advisory. krb5: integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the CIQ security advisory...

pois0nSword

pois0nSword 개발 중이며, 현재 사용자에게 유용하지 않습니다. pois0nSword는 궁극적으로 사용자 인터페이스 커스터마이징을 가능하게 하는 것을 목표로 하는 iOS 프로젝트입니다. 현재는 iOS 26.1에서 cve-2025-43529를 이용한 임의 웹 콘텐츠 읽기/쓰기 데모입니다. 또한 CVE-2026-20700을 활용한 PAC 우회도 포함합니다. 크레딧: GenericCoding - 메인 개발자 varik - 메인 개발자 zeroxjf - 웹 콘텐츠 r/w 수정 및 디버깅 R/W 프리미티브 PAC 우회 / 오프셋...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

CLSA-2026-1790104586 TuxCare security update for pac-resolver (1 CVE)

TuxCare rebuilt pac-resolver to address 1 CVE. Fixed in 4.2.0-tuxcare.1...

Astra Linux – Vulnerability in Heimdal, KRB5

PAC parsing in MIT Kerberos 5 also known as krb5 before versions 1.19.4 and 1.20.x before version 1.20.1 contains integer overflows that may lead to remote code execution in the KDC, kadmind, or a GSS or Kerberos application server on 32-bit platforms. This results in a heap-based buffer overflow...

CVE-2026-82777

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82776

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82778

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...