PT-2026-109328

Name of the Vulnerable Software and Affected Versions Trident versions v25.02.1 through v26.06.1 Description An authenticated attacker with access to debug logs can view sensitive information, including LUKS passphrases and SMB Active Directory credentials. Recommendations Update Trident to a...

cdt-vulnsamba-deploy

CDT Team Delta - Vulnerable Samba Deployment Overview This repo is an Ansible-based deployment of a vulnerable Samba file server affected by CVE-2017-7494, a critical remote code execution vulnerability. This will hopefully be deployed for team Delta during the Grey Team phase. Vulnerability...

CVE-2024-38077

CVE-2024-38077-EXP Fixed code based on pseudocode. Scope EXP: Windows Server 2025 POC: 08-25 Usage options: -h, --help show this help message and exit --targetip TARGETIP Target IP, eg: 192.168.120.1 --evilip EVILIP Evil IP, eg: 192.168.120.2 --evildllpath EVILDLLPATH Evil dll path, eg:...

chuckle

Chuckle - An automated SMB Relay Script. Chuckle requires a few tools to work: SMBRelayX.py Veil latest version from git Responder Chuckle will detect which version you are using. Nmap Nbtscan unixwiz MSFconsole Usuage should be fairly simple, run as root or use sudo: sudo ./chuckle.sh Wait a whi...

chuckle

Chuckle - Ein automatisiertes SMB-Relay-Skript. Chuckle benötigt ein paar Werkzeuge, um zu funktionieren: SMBRelayX.py Veil neueste Version von git Responder Chuckle erkennt, welche Version du verwendest. Nmap Nbtscan unixwiz MSFconsole Die Verwendung ist recht einfach: Als Root ausführen oder su...

OutlookLeakTest

The Outlook HTML Leak Test Project! Blog post: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ What's in "./Schemes-List.xlsx"? List of URI schemes that might work in Windows. These schemes/protocols can be useful in...

EternalBlue-Exploit-Demonstration

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

EternalBlue-Exploit-Demonstration-MS17-010

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

BLUE-WRITEUP-CVE-2017-0144

Blue — Windows Security Assessment Overview This repository contains a technical write-up of the security assessment performed against the Blue vulnerable Windows virtual machine. The assessment was conducted within an authorized laboratory environment to examine the process of identifying,...

CVE-2025-33073

CVE-2025-33073 PoC Exploit for the NTLM reflection SMB flaw. All credits go to the offical research: https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 Prerequisites OS: Kali Linux has most packages pre-installed. NetExec NXC ...

CVE-2025-24071-POC

sudo apt update sudo apt install wine wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP creado: try.zip impacket-smbserver: smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket Exegol fork v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated...

windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB Client Vulnerability Research Framework Author: cyberseallll Created: 2025 Overview I developed this research framework to analyze and understand CVE-2025-33073, a critical Windows SMB Client Elevation of Privilege vulnerability. This implementation provides comprehensive tools for...

CVE-2025-24054-24071---Metasploit-Module

CVE-2025-24054/24071 - Metasploit Module Overview The vulnerability occurs during the extraction process of a .zip file. When interacting with a specially crafted .library-ms file, Windows Explorer processes the internal XML schema and automatically initiates an SMB authentication request to a...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

CVE-2026-24294

CVE-2026-24294 - Local NTLM Reflection LPE via SMB Arbitrary Port Local privilege escalation on Windows Server 2025 via NTLM reflection, abusing the SMB arbitrary port feature introduced in Windows 11 24H2 / Server 2025. Vulnerability Windows 11 24H2 / Server 2025 introduced an SMB client feature...

CVE-2024-21413-Microsoft-Outlook-Moniker-Link-Vulnerability

CVE-2024-21413 – Microsoft Outlook Moniker Link Vulnerability Overview This repository documents my hands-on analysis of CVE-2024-21413 Moniker Link , a critical Microsoft Outlook vulnerability that bypasses Protected View to leak Windows NetNTLMv2 credentials via SMB authentication. Severity:...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full walkthrough of TryHackMe's "Moniker Link" room: weaponizing CVE-2024-21413, a 2024 Microsoft Outlook vulnerability, to steal a victim's NTLMv2 hash the moment they click a link in a phishing email — no macro, no attachment, no obvious...

detect-ransomware-filenames

Detect Ransomware Filenames This package/script watches SMB transactions to look for known bad filenames that ransomware is known to use. It rides on top of the Anti-Ransomware File System Resource Manager Lists maintained here. How to use A Python script download-list.py is included to be able t...

CVE-2022-26810

CVE-2022-26809 RCE Exploit CVE description CVE-2022-26809 - weakness in a core Windows component RPC earned a CVSS score of 9.8 not without a reason, as the attack does not require authentication and can be executed remotely over a network, and can result in remote code execution RCE with the...

CVE-2007-2447-RCE

This exploit helps you to get a reverse shell, exploting Samba 3.0.20 3.0.25 · When executing the script with python3 with the --help parameter, it asks us for a series of parameters --lhost LHOST your host ip where the shell will be received --lport LPORT your port port where the shell will be...