CVE-2020-1472

CVE-2020-1472 arp-scan Rangip nmap -A -vv -Pn IPADDR python3 setemptypw.py DCNETBIOSNAME DCIPADDR python3 secretsdump.py -no-pass -just-dc DOMAIN/DCNETBIOSNAME$@DCIPADDR python3 wmiexec.py -hashes HassPasswdUser DOMAIN/User@dcipaddr windows command whoami systeminfo hostname md testdir echo test...

ZeroLogon-to-Shell

This is a combination of the zerologontester.py code and the tool evil-winrm to get a shell. I just added a "os.system" to use evil-winrm. Requirements: To get the Administrator NTLM HASH I recommend you to use secretsdump tool from impacket And, of course, you need to install evil-winrm This is...

gladius

Gladius Responder에서 자격 증명까지의 쉬운 모드 저자: Cory Duplantis @ctfhacker / 블로그 Gladius 블로그 포스트 asciicast Gladius는 공격 중 다양한 소스로부터 자격 증명을 크래킹하는 자동화된 방법을 제공합니다. 현재 Responder, secretsdump.py, smarthashdump에서 해시를 크래킹합니다. 설치 root@kitploit: pip install watchdog git clone...

SharpSecDump

SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against : Usage SharpSecDump.exe -target=192.168.1.15 -u=admin...

CVE-2020-1472

复现完了有点小BUG，重启后会卡在登录页面比较久。不知道是不是只有我会。谨慎在真实环境利用 实战中可以使用secretsdump.py 的 -use-vss和-history获取历史hash进行恢复. 第一步 pip3 install -r requirements.txt 查看hash secretsdump.py molecule-labs.com/administrator:[email protected] -just-dc-user 'AD$' 攻击 python3 CVE-2020-1472.py AD AD$ 192.168.175.132 查询域控hash...

cve-2020-1472

CVE-2020-1472 POC mac 환경에서 proxychains 프록시를 통해 Windows 도메인 환경에서 이 취약점을 재현합니다. 환경 DC주 도메인 컨트롤러: Domain User도메인 구성원 호스트: gost로 socks5 정방향 프록시를 직접 설정합니다. Attack Hacker공격 머신: proxychains4 설정 root@kitploit: vim /Users/xq17/.proxychains/proxychains.conf PrxoyList 목록에 다음을 추가합니다 ProxyList socks5...

CVE-2021-36934

CVE-2021-36934 SeriousSAM 자동 익스플로이터 요구 사항 HiveNightmare , 실행 파일 또는 이에 상응하는 DLL DLL 버전은 rundll32를 통해 실행하려면 약간의 코드 수정이 필요하며, AppLocker 환경에서 유용할 수 있습니다. dump.exe m pyinstaller로 컴파일된 secretsdump.py로, 모든 모듈과 Python 자체를 포함하고 있기 때문에 꽤 큽니다. 이것을 DLL로 만들 필요가 없는 이유는 원한다면 hashcat API와 함께 서버 측에서 호출할 수 있기 때문이며...

adiskreader-secretsdump

🚩 スポンサー このプロジェクトが気に入ったら、ブラウザで動作するフルペンテストスイートである OctoPwn のライセンス購入をご検討ください。 新しいビルド/リリースやその他の情報の通知を受け取るには、私たちの Discord に参加してください。 adiskreader-secretsdump ローカルまたはリモートのディスクイメージからレジストリとNTDSのシークレットを抽出します 🚩 ブラウザで動作します このプロジェクトは、他の多くのペンテスターツールと同様に、OctoPwnの力でブラウザ上で動作します。 コミュニティ版は OctoPwn - Live でチェックしてください...

Exploit for CVE-2020-1472

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

Exploit for CVE-2020-1472

ZeroLogon - Exploit and Example Modified the test PoC from Se...

Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a Windows ZeroLogon vulnerability. The exploit targets the Netlogon service on a Domain Controller DC and allows an attacker to set an empty password for the DC's machine account. This is achieved by exploiting the vulnerability in the Netlogon service, which allows...

Exploit for CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privileg...

Exploit for CVE-2020-1472

Introduction article https://www.yuque.com/shamo-vs4ia/vul/kt...

Exploit for CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC !alt texthttps://github.com...

Exploit for CVE-2020-1472

The reproduction process has a minor bug; after restarting, it g...

Exploit for CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHubh...

HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Often, this i...

Gladius - Easy mode from Responder to Credentials

Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and smarthashdump. Install pip install watchdog git clone https://www.github.com/praetorian-inc/gladius cd gladius git clone...