RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

kerberoast

kerberoast Kerberoast is a series of tools for attacking MS Kerberos implementations. Below is a brief overview of what each tool does. Extract all accounts in use as SPN using built in MS tools PS C:\ setspn -T medin -Q / Request Tickets One ticket: PS C:\ Add-Type -AssemblyName...

CVE-2026-13097: Use of Incorrectly-Resolved Name or Reference

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

ResetNightmare-Python

ResetNightmare PoC CVE-2026-27912 Python/impacket re-implem...

CVE-2026-54365

CentreStack prior to version 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An attacker can send a crafted base64-encoded XML via exposed API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn) to trigger InternalImportAdUserByUPN(), ...

PT-2026-66466

Name of the Vulnerable Software and Affected Versions CentreStack versions prior to 17.3 Description An unauthenticated deserialization issue exists in GSNamespace.dll. This allows remote attackers to create arbitrary local OS user accounts and create directories on the server filesystem by sendi...

OpenBMC bmcweb Authentication Bypass

Proof of concept that demonstrates an OpenBMC bmcweb AUTH-F6 mTLS UPN Suffix authentication bypass vulnerability via a parent-domain certificate...

Onboarding a Microsoft 365 Organization Fails with: service principal name is already present for the tenant

Challenge When signing in with a device code during onboarding of a Microsoft 365 organization in Veeam Data Cloud for Microsoft 365 , the following error occurs: AADSTS650051: Consent action for Application '' failed due to following error: The service principal name is already present for the...

CVE-2026-45108

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant DAG flow that allowed a user within the same Entra ID domain to obtain a local Unix...

Unity Linux 20.1060e / 20.1070e Security Update: samba (UTSA-2026-017353)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017353 advisory. The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenSSH vulnerabilities (USN-8222-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8222-1 advisory. Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol -O option. Thi...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

CVE-2025-11561

CVE-2025-11561 affects the System Security Services Daemon (SSSD) on Linux in default AD integration configurations. A fallback path from the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) to the an2ln plugin can be taken if AD attributes (e.g., userPrincipalName or samAccountN...

EUVD-2015-8508

Malware in sbrugna...

EUVD-2024-51116

Malicious code in bioql PyPI...

EUVD-2022-15499

Malicious code in bioql PyPI...

Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)

This module will try to find Service Principal Names that are associated with normal user accounts. Since normal accounts' passwords tend to be shorter than machine accounts, and knowing that a TGS request will encrypt the ticket with the account the SPN is running under, this could be used for a...

CVE-2024-12802

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN User Principal Name and SAM Security Account Manager account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and...