SharpSecDump

SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against : Usage SharpSecDump.exe -target=192.168.1.15 -u=admin...

cve-2020-1472

CVE-2020-1472 POC Replicate this vulnerability in a Windows domain environment using proxychains proxy on macOS. Environment DC Primary Domain Controller: Domain User Domain Member Host: Set up a SOCKS5 forward proxy directly via gost. Attack Hacker Attacker Machine: Configure proxychains4...

CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

adiskreader-secretsdump

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord adiskreader-secretsdump Extract registry and NTDS secrets from local or remote disk...

CVE-2020-1472

CVE-2020-1472 arp-scan Rangip nmap -A -vv -Pn IPADDR python3 setemptypw.py DCNETBIOSNAME DCIPADDR python3 secretsdump.py -no-pass -just-dc DOMAIN/DCNETBIOSNAME$@DCIPADDR python3 wmiexec.py -hashes HassPasswdUser DOMAIN/User@dcipaddr windows command whoami systeminfo hostname md testdir echo test...

ZeroLogon-to-Shell

This is a combination of the zerologontester.py code and the tool evil-winrm to get a shell. I just added a "os.system" to use evil-winrm. Requirements: To get the Administrator NTLM HASH I recommend you to use secretsdump tool from impacket And, of course, you need to install evil-winrm This is...

CVE-2021-36934

CVE-2021-36934 SeriousSAM Auto Exploiter Requirements HiveNightmare , executable or a DLL equivelant of it the DLL equivelant would require some code modifications in order to run it through rundll32, this could be useful when you run into applocker environments. dump.exe m which is a pyinstaller...

gladius

Gladius 从 Responder 到凭证的简易模式 作者：Cory Duplantis（@ctfhacker）/ 博客 关于 Gladius 的博客文章 asciicast Gladius 提供了一种自动化的方法，用于在渗透测试过程中从各种来源破解凭证。目前，我们支持破解来自 Responder、secretsdump.py 和 smarthashdump 的哈希值。 安装 root@kitploit: pip install watchdog git clone https://www.github.com/praetorian-inc/gladius cd gladius gi...

Exploit for CVE-2020-1472

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

Exploit for CVE-2020-1472

ZeroLogon - Exploit and Example Modified the test PoC from Se...

Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a Windows ZeroLogon vulnerability. The exploit targets the Netlogon service on a Domain Controller DC and allows an attacker to set an empty password for the DC's machine account. This is achieved by exploiting the vulnerability in the Netlogon service, which allows...

Exploit for CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privileg...

Exploit for CVE-2020-1472

Introduction article https://www.yuque.com/shamo-vs4ia/vul/kt...

Exploit for CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC !alt texthttps://github.com...

Exploit for CVE-2020-1472

The reproduction process has a minor bug; after restarting, it g...

Exploit for CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHubh...

HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Often, this i...

Gladius - Easy mode from Responder to Credentials

Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and smarthashdump. Install pip install watchdog git clone https://www.github.com/praetorian-inc/gladius cd gladius git clone...