13 matches found
go-secdump
go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...
SMB_CVE-2025-24071
CVE-2025-24071 概念验证 SMB + TAR 提取方法 这是利用 CVE-2025-24071 的概念验证代码，该漏洞存在于 Windows 中，允许通过 .library-ms 文件泄露 NTLM 哈希。此版本与其他版本略有不同，它使用 .tar 存档而不是 .zip，这提高了在纯 SMB 环境中的兼容性。 📌 为什么选择 .tar 而不是 .zip？ 大多数公开的概念验证使用 .zip 来打包恶意的 .library-ms 文件。但是，如果你在受限的 SMB 环境中工作（例如，只能通过 smbclient 访问），则无法远程解压 ZIP 文件。通过使用 .tar...
lsassy
lsassy 用于在一组主机上远程提取凭据的Python工具。这篇博客文章解释了其工作原理。 该工具使用impacket项目远程读取lsass转储中的必要字节，并使用pypykatz提取凭据。 章节| 描述 ---|--- 警告| 使用此工具前请阅读此章节 安装| Lsassy安装 基本用法| 基本lsassy用法 高级用法| 高级lsassy用法及参数说明 添加转储方法| 如何添加自定义lsass转储方法 致谢| 感谢这些人员及工具 官方Discord| 官方Discord服务器 警告 尽管我已尽一切努力使工具稳定，但发生错误时可能会留下痕迹。...
CVE-2026-45433
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and...
EUVD-2026-34251
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and...
CVE-2026-32885: Improper Limitation of a Pathname to a Restricted Directory
DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...
PT-2023-21549 · Sage · Sage 200 Spain
Name of the Vulnerable Software and Affected Versions: Sage 200 Spain version 2023.38.001 Description: The issue is related to plaintext credential usage, which could allow a remote attacker to extract SQL database credentials from the DLL application. This could be linked to known techniques to...
CVE-2023-30620: Improper Limitation of a Pathname to a Restricted Directory
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using tarfile.extractall from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the...
SQL Injection in phili67/ecclesiacrm
✍️ Description SQL Injection SQLi found in search section for http://YOURIP/ecclesiacrm/v2/people/list/person. A SQL Injection allows an attacker to run SQL command remotely and can extract information such as password, usernames and other sensitive data. This SQLi is a blind SQLi and doesn't...
Lsassy - Extract Credentials From Lsass Remotely
Python library to remotely extract credentials. This blog post explains how it works. You can check the wiki This library uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Requirements Python = 3.6 pypykatz = 0.3.0 impacket Installation From...
Authentication flaw
In all versions of ABB Power Generation Information Manager PGIM and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device...
Spectre attack variant can be remotely mounted to extract sensitive data
By ghostadmin What we know so far about Spectre attacks is that it relies upon execution of malicious code. The code is executed on computers having speculative-execution design flaws in processor chip; once a device is compromised, it becomes possible to obtain sensitive data such as passwords,...