SharpSCOM

SharpSCOM Una herramienta C para interactuar con Microsoft System Center Operations Manager SCOM. Esta herramienta ha sido probada contra la versión 10.22.10118.0 del servidor SCOM. La integración SSPI se proporciona a través de la librería nsspi de Kevin Thompson antiduh, publicada bajo la...

CVE-2025-32462-POC

CVE-2025-32462 – sudo -h PoC de Escalada de Privilegios 🚨 Exploit de escalada de privilegios local para sudo mediante el argumento -h/--host Afecta a sistemas con configuraciones incorrectas de sudo que permiten acceso root no deseado. 🧠 Acerca de Este PoC demuestra CVE-2025-32462 , un fallo lógi...

SCOMDecrypt

SCOMDecrypt - Herramienta de descifrado de credenciales de SCOM Publicado como código abierto por NCC Group Plc - http://www.nccgroup.trust/ Desarrollado por Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt Publicado bajo AGPL, consulta LICENSE...

nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

SSH-Stealer

RunAs-Stealer Smart keylogging capability to steal SSH Credentials including password & Private Key Usage The stolen credentials are written to C:\Users\Desktop\desktop.ini ADS log stream. To get the credentials type the cmd command: more \Desktop\desktop.ini:log" To remove the stored credentials...

PowerShell-Suite

PowerShell-Suite Hay grandes herramientas y recursos en línea para realizar casi cualquier tarea en PowerShell; sin embargo, a veces es necesario crear un script de utilidad para un propósito específico o para salvar una brecha ontológica. Esta es una colección de utilidades de PowerShell que arm...

RemoteMonologue

RemoteMonologue RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM. Read X-Force Red's RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions for...

Rocky Linux 9 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2023_0282)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230282 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource (crlsa-2023_0284)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230284 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

RunAs-Stealer

RunAs-Stealer Stealer de credenciales de la utilidad RunAs que implementa 3 técnicas: Hooking de CreateProcessWithLogonW, Keylogging inteligente y Depuración remota Uso Los stealers se ejecutan en un bucle while el inyector también en el caso de Hooking en segundo plano; para finalizarlos usa el...

cisco-CVE-2023-20075

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Local Privilege Escalation and Shell Escape CVE: CVE-2023-20075 Timeline: Discovered - ly1g3 Reported - ly1g3 Fixed - Cisco Cisco...

poc-cve-2019-14287

PoC de CVE-2019-14287 Resumen Es un ejemplo que reproduce la vulnerabilidad de sudo CVE-2019-14287 en un contenedor Docker. Procedimiento del ejercicio 1. Levantar el contenedor con docker compose up -d 2. Entrar al contenedor con docker exec -it vulnerablesudoapp bash 3. Ejecutar los comandos...

Astra Linux – Vulnerability in sudo

In Sudo version 1.8.29, the fact that a user has been blocked for example, by using the “!” character in the shadow file instead of a password hash was not taken into consideration. This allows an attacker who has access to a Runas ALL sudoer account to impersonate any blocked user. NOTE: The...

Astra Linux – Vulnerability in sudo

In Sudo version 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a non-existent user by executing sudo with a numerical UID that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability, as executing a command via sudo a...

CVE-2026-14852

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database...

MiracleLinux 7 : sudo-1.8.23-10.el7.3 (AXSA:2023-4846:02)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-4846:02 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : sudo-1.9.5p2-7.el9.1 (AXSA:2023-4872:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4872:03 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the...

CVE-2001-1517

RunAs runas.exe in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying tha...

CVE-2001-1518

RunAs runas.exe in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service RunAs hang by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the...

BIT-WILDFLY-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...