65 matches found
RiskySPN
RiskySPNs RiskySPNsは、SPN Service Principal Name に関連付けられたアカウントを検出および悪用することに焦点を当てたPowerShellスクリプトのコレクションです。このモジュールは、ブルーチームが潜在的に危険なSPNを特定するのに役立つ一方、レッドチームがKerberosとActive Directoryを活用して権限を昇格させるのにも役立ちます。 詳細情報：http://www.cyberark.com/blog/service-accounts-weakest-link-chain/ 使用方法 モジュールのインストール...
kerberoast
kerberoast Kerberoastは、MS Kerberos実装を攻撃するための一連のツールです。以下は各ツールの機能の簡単な概要です。 組み込みのMSツールを使用してSPNとして使用中のすべてのアカウントを抽出する root@kitploit: PS C:\ setspn -T medin -Q / チケットを要求する 1枚のチケット: root@kitploit: PS C:\ Add-Type -AssemblyName System.IdentityModel PS C:\ New-Object...
CVE-2026-54365
CentreStack prior to version 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An attacker can send a crafted base64-encoded XML via exposed API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn) to trigger InternalImportAdUserByUPN(), ...
PT-2026-66466
Name of the Vulnerable Software and Affected Versions CentreStack versions prior to 17.3 Description An unauthenticated deserialization issue exists in GSNamespace.dll. This allows remote attackers to create arbitrary local OS user accounts and create directories on the server filesystem by sendi...
CVE-2026-45108
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant DAG flow that allowed a user within the same Entra ID domain to obtain a local Unix...
Unity Linux 20.1060e / 20.1070e Security Update: samba (UTSA-2026-017353)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017353 advisory. The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of...
Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenSSH vulnerabilities (USN-8222-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8222-1 advisory. Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol -O option. Thi...
sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems
A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...
sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems
A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...
sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems
A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...
CVE-2025-11561
CVE-2025-11561 affects the System Security Services Daemon (SSSD) on Linux in default AD integration configurations. A fallback path from the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) to the an2ln plugin can be taken if AD attributes (e.g., userPrincipalName or samAccountN...
EUVD-2015-8508
Malware in sbrugna...
EUVD-2022-15499
Malicious code in bioql PyPI...
EUVD-2024-51116
Malicious code in bioql PyPI...
Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)
This module will try to find Service Principal Names that are associated with normal user accounts. Since normal accounts' passwords tend to be shorter than machine accounts, and knowing that a TGS request will encrypt the ticket with the account the SPN is running under, this could be used for a...
CVE-2024-12802
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN User Principal Name and SAM Security Account Manager account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and...
SSL-VPN MFA Bypass Due to UPN and SAM Account Handling in Microsoft AD
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN User Principal Name and SAM Security Account Manager account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and...
PT-2025-1026
Name of the Vulnerable Software and Affected Versions SonicWall SSL-VPN Gen6 affected versions not specified SonicWall SSL-VPN Gen7 affected versions not specified SonicWall SSL-VPN Gen8 affected versions not specified Description An authentication bypass exists in SonicWall SSL-VPN when integrat...
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally an attacker who can intercept traffic can impersonate existing services resulting in a loss of confidentiality and integrity.
...