PT-2026-91522

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

PT-2026-90993

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...

CVE-2025-68624

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...

KrbRelayUp

KrbRelayUp Simple wrapper around some of the features of Rubeus and KrbRelay and a few other honorable mentions in the acknowledgements section in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Local machine account...

CVE-2023-23397-Report

CVE-2023-23397-Report An exploitation demo of Outlook Elevation of Privilege Vulnerability CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB TCP 445 share on a threat...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumerates CLSID and AppID entries from the Windows registry to identify COM objects associated with Windows services via the LocalService value. The function correlates these entries, exports the results to a CSV file, and attempts COM activation when the related...

SMB-CVE-2025-33073

SMB-CVE-2025-33073 高级SMB蜜罐：CVE-2025-33073研究与实现 高级SMB蜜罐：CVE-2025-33073研究与取证 📌 项目概述 本项目展示了一个高交互蜜罐环境，旨在研究、检测和分析针对SMB（服务器消息块）协议的利用尝试。具体而言，该研究聚焦于CVE-2025-33073 ，探索NTLM反射与中继漏洞。 该系统部署在面向公网的VPS上，以模拟存在漏洞的企业文件服务器，吸引真实攻击者并实时捕获他们的技术手段。 🚀 主要特性 高交互SMB诱饵： 一个功能完整的基于Samba的服务器，专门配置为高价值目标。 动态蜜饵文件：...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...

NegoExRelay

Negoexrelayx - Negoex relaying tool Toolkit for abusing Kerberos PKU2U and NegoEx. Requires impacket It is recommended to install impacket from git directly to have the latest version available. negoexrelayx.py This tool allows you to relay NegoEx with PKU2U authentication to other copmuter and...

CVE-2020-5148

CVE-2020-5148 SonicWall UTM SSO 代理中的强制认证 SonicWall SSO 代理通过使用 NetAPI（默认）或 WMI 探测工作站，来识别给定 IP 地址背后的用户。它在启动 NTLM 认证之前不会验证工作站，并且在会话生命周期内会持续轮询同一地址。 由于 SSO 代理服务需要在其探测的每个工作站和服务器上具有管理员权限，因此在实践中它通常以域管理员身份部署。任何能够通过 UTM 设备路由 Web 流量的未认证方，都可以使域管理员帐户向攻击者选择的主机进行认证，并捕获或中继该认证。 已发布为 CVE-2020-5148，厂商安全公告...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 是一个存在于允许 NTLM 身份验证的系统中的漏洞。NTLM 是一种旧协议，可能被利用进行凭据中继攻击或暴力破解攻击。当 NTLM 被启用时，该漏洞会使系统容易受到未授权访问的影响，攻击者仅需极少的交互就可能泄露用户的 NTLMv2 哈希值。 此检测脚本的工作原理如下： 注册表路径检查： 从注册表路径 HKLM:\SYSTEM\CurrentControlSet\Control\Lsa 读取 LmCompatibilityLevel 值。 配置评估： 如果 LmCompatibilityLeve...

CVE-2020-13941

CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr Multiple Solr endpoints have been found to accept absolute paths. In Windows systems these absolute path can be forced to make the OS connect to an attacker-controlled SMB server. This behaviour may result in attacks such as...

Potato

Potato Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012 How it works Potato takes advantage of known issues in Windows to gain local privilege escalation, namely NTLM relay specifically HTTP-SMB relay and NBNS spoofing. Using the techniques outlined below, it is possible for an...

UltraRealy_with_CVE-2019-1040

UltraRelay Updated by Lazaar Sami for the exploit CVE-2019-1040 UltraRelay is a tool for LLMNR poisoning and relaying NTLM credentials. It is based on Responder and impack. I have updated the original version https://github.com/5alt/ultrarelay for the exploit CVE-2019-1040. Dirk-jan Mollema has...

hive

From WikiLeaks: Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware. Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a targe...

CVE-2025-33073

Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...

CVE-2025-55234

CVE-2025-55234 This vulnerability allows attackers to perform relay attacks against the SMB Server Message Block protocol. If successful, it can lead to Elevation of Privilege EoP essentially allowing unauthorized users to gain higher-level access on a system By Mark Mallia Issue This vulnerabili...

Metasploit Wrap Up: This One Goes to Sixteen!

This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the...

smbtakeover

smbtakeover A technique to unbind and rebind 445/tcp on Windows without loading a driver, loading a module into LSASS, or rebooting the target machine. Implemented to ease the burden of SMB-based NTLM relays while operating over C2. Technical analysis of the technique is dicussed in more detail...