SMBetray

SMBetray Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to intercept and modify insecure SMB connections, as well as compromise some secured SMB connections if credentials are known. Background Released at Defcon26 at "SMBetray - Backdooring and Breaking Signatures" I...

SMBetray

SMBetray 版本 1.0.0。该工具是一个概念验证，展示攻击者能够拦截和修改不安全的 SMB 连接，以及在已知凭据的情况下破坏某些安全 SMB 连接的能力。 背景 在 Defcon26 上发布，题为“SMBetray - Backdooring and Breaking Signatures” 在 SMB 连接中，保护服务器与客户端之间传输数据完整性的安全机制是 SMB 签名和加密。当使用 SMB 签名时，SMB 数据包中的签名基于在身份验证阶段通过网络明文传输的信息以及用户密码派生出的密钥。如果已知用户密码，攻击者可以重新创建 SessionBaseKey 及所有其他 SMB...

ridrelay

RidRelay 快速简便的方法，在内部网络中获取域用户名。 联系我：@skorov8 工作原理 RidRelay 结合了NTLM中继攻击、常见的lsarpc查询和RID循环来获取域用户名列表。它执行以下步骤： 1. 启动SMB和HTTP服务器，等待传入连接 2. 将传入的凭据中继到指定目标，以中继用户的上下文建立连接 3. 通过SMB连接向lsarpc管道发出查询，以获取域用户名列表。这是通过循环最多50000个RID完成的 4. 通过samr管道提取密码策略 （为获得最佳效果，请与Responder一起使用） 依赖 Python 3.6 Impacket v0.9.20-dev或更高...

CVE-2025-55234

CVE-2025-55234 此漏洞允许攻击者对 SMB（服务器消息块）协议执行中继攻击。若成功利用，可导致权限提升（EoP），使未授权用户获取系统上的更高访问权限。 作者：Mark Mallia 问题 此漏洞允许攻击者对 SMB（服务器消息块）协议执行中继攻击。若成功利用，可导致权限提升——实质上使未授权用户获取系统上的更高访问权限。SMB 由于在企业环境中广泛使用以及历史上存在严重缺陷，长期以来一直是攻击者的目标。例如，CVE-2020-1301 通过畸形请求导致 SMBv1 远程代码执行，而 CVE-2022-32230 通过 SMBv3 空指针解引用导致拒绝服务。臭名昭著的...

Window-7--Vulnerability-and-Exploitation.

Windows 7 Vulnerability Assessment & Exploitation Lab 🎯 Ob...

CVE-2026-43377

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBDDEBUGAUTH logging is enabled, generatesmb3signingkey and generatesmb3encryptionkey log the session, signing, encryption, and decryption key bytes. Remo...

CVE-2026-43377 ksmbd: Don't log keys in SMB3 signing and encryption key generation

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBDDEBUGAUTH logging is enabled, generatesmb3signingkey and generatesmb3encryptionkey log the session, signing, encryption, and decryption key bytes. Remo...

Azure Linux 3.0 Security Update: samba (CVE-2017-12150)

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2017-12150 advisory. - It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce SMB signin...

MiracleLinux 4 : samba-3.6.23-45.AXS4 (AXSA:2017-2303:05)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2303:05 advisory. A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories in areas of the server file...

EUVD-2016-0918

Malware in sbrugna...

EUVD-2016-5006

Malware in sbrugna...

About Elevation of Privilege – Windows SMB Client (CVE-2025-33073) vulnerability

About Elevation of Privilege - Windows SMB Client CVE-2025-33073 vulnerability. A vulnerability from the June Microsoft Patch Tuesday allows an attacker to execute a malicious script, forcing the victim's host to connect to the attacker's SMB server and authenticate, resulting in gaining SYSTEM...

CLSA-2025-1747688581 kernel: Fix of 15 CVEs

media: uvcvideo: Fix double free in error path CVE-2024-57980 - vrf: use RCU protection in l3mdevl3out CVE-2025-21791 - geneve: Fix use-after-free in genevefinddev. CVE-2025-21858 - ibmvnic: Don't reference skb after sending to VIOS CVE-2025-21855 - pfifotailenqueue: Drop new packet when...

OESA-2025-1446 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans There is a kernel API ntbmwcleartrans would pass 0 to both addr and size. This would make...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2reconnectserver CVE-2024-35870 In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount CVE-2024-49960 In the Linux kernel, the...

PT-2025-24857

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description Improper access control in the Windows SMB client, specifically within the mrxsmb.sys driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the NT...

UBUNTU-CVE-2024-53179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses-authkey.response with SMB2.1 + sign mounts which occurs due to following race: task A task B cifsmount dfsmountshare getsession...

RHEL 5 : samba (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - samba: symlink race permits opening files outside share directory CVE-2017-2619 - samba: Netlogon elevati...

CVE-2023-47574

An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. There is a Weak SMB configuration with signing disabled...

K53313971: Samba vulnerabilities CVE-2016-2110 and CVE-2016-2115

Security Advisory Description CVE-2016-2110 The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove...