ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM 泄露 新漏洞允许通过一次点击从浏览器泄露NTLM哈希 作者：Ruben Enkaoua 描述 Microsoft ms-photos URI 方案将 fileName 作为参数，该参数可以提交带有 UNC 路径，在打开时泄露 NTLMv2-SSP 哈希。通过构造一个特殊格式的链接，攻击者可以强迫受害者直接从浏览器启动 Microsoft Photos 应用。当触发时，此行为会导致受害者的 NTLMv2-SSP...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

rpcfirewall

I Need More Information Check out our RPC Firewall blog post or our BlackHat talk to gain better understanding of RPC, RPC attacks, and the solution: RPC Firewall. Join our |Zero| Labs Slack Community workspace for any questions, issues, or simply to shout out. We would love to hear from you also...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder 从 Windows 注册表中枚举 CLSID 和 AppID 条目，以识别通过 LocalService 值与 Windows 服务关联的 COM 对象。 该函数关联这些条目，将结果导出到 CSV 文件，并在相关服务运行时尝试 COM 激活。它主要用于帮助在中继攻击和其他 LPE 场景中识别可用的 CLSID。 使用方法 root@kitploit: PS C:\Users\Administrator\Desktop Import-Module .\CLSIDFinder.ps1 PS...

CVE-2026-0522 Local File Inclusion in the File Upload/Download Process

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

VertiGIS FM 安全漏洞

VertiGIS FM is a facility and asset management platform from VertiGIS Corporation. Version 10.5.00119 of VertiGIS FM contains a security vulnerability. This vulnerability stems from the inclusion of local files during the upload/download process. It could allow authenticated attackers to read any...

Cocos AI 访问控制错误漏洞

Cocos AI is an AI security computing platform based on a trusted execution environment, open-sourced by Ultraviolet. Cocos AI versions 0.8.2 and earlier contain an access control vulnerability. This vulnerability stems from a proven TLS design that has weaknesses in relay attacks, allowing...

Windows File Explorer NTLM Forced Authentication Hash Disclosure 1.0

Windows File Explorer contains persistent forced authentication behavior that automatically transmits NTLM challenge-response hashes to remote SMB/WebDAV endpoints during routine file operations, enabling credential theft and potential domain compromise through NTLM relay attacks. This is not an...

Microsoft Windows 11 24H2 NTLM Relay Orchestrator Privilege Escalation

This Metasploit module checks the SMB Signing status on remote targets. If signing is not required, the target is vulnerable to NTLM Relay attacks. It serves as an automated pre-flight check for relay operations...

SmarterTools SmarterMail security vulnerability

SmarterTools SmarterMail is a set of email server software developed by SmarterTools Corporation. This software supports features such as spam filtering, data statistics, and Simple Mail Transfer Protocol SMTP authentication. Previous versions of SmarterTools SmarterMail, including version 9518,...

EUVD-2025-203407

An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUSLOGONFAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the netwo...

Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025

Just like the 2000s Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow...

EUVD-2010-2357

Malware in sbrugna...

EUVD-2015-4903

Malware in sbrugna...

EUVD-2016-6117

Malware in sbrugna...

EUVD-2019-18936

Malware in sbrugna...

EUVD-2015-4866

Malware in sbrugna...

EUVD-2025-27294

Malicious code in bioql PyPI...

EUVD-2022-0662

Malicious code in bioql PyPI...

PrivExchange

This is a proof-of-concept PoC tool for abusing Microsoft Exchange to obtain Domain Admin privileges. The tool, named PrivExchange, requires the Impacket library and can be used to subscribe to push notifications on Exchange Web Services, which will make Exchange connect back to the attacker and...