krbrelayx

Krbrelayx - Kerberos 中继和无约束委派滥用工具包 用于滥用 Kerberos 的工具包。 运行需要 impacket、ldap3 和 dnspython。 建议直接从 git 安装 impacket，以获得最新版本。 有关此工具包的更多信息，请参见我的博客 https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/。有关 Kerberos 中继的信息，请参阅后续博客...

kerberoast

🚩 スポンサー このプロジェクトが気に入ったら、GitHubでスポンサーになることを検討してください！ スポンサーになる kerberoast Kerberos攻撃ツールキット -純Python- インストール pip3 install kerberoast 前提条件 Python 3.6 requirements.txtを参照 待ちきれない方へ 重要：LDAPおよびKerberosで受け入れられるターゲットURLの形式は以下の通りです : +://:@/?= : +://:@/?= 手順 -SSPI使用時-: kerberoast auto 手順 -SSPI未使用-: 1...

getSPNless

getSPNless 获取 Kerberos 服务票据的 Python 工具，使用无 SPN 技术。基于 利用普通用户账户进行 RBCD 攻击。 该工具使用 impacket 项目。 安装 这些工具仅兼容 Python 3.5 以上版本。从 GitHub 克隆仓库，安装依赖项后即可使用： root@kitploit: git clone https://github.com/jarnovandenbrink/getSPNless.git cd getSPNless python3 -m pip install . 建议使用虚拟环境（virtualenv）。 用法 root@kitploi...

ActiveDirectoryEnumeration

ADE - ActiveDirectoryEnum root@kitploit: python -m ade usage: ade -h --dc DC -o OUTFILE -u USER -s -smb -kp -bh -spn -sysvol --all --no-creds --dry-run --exploit EXPLOIT / | / / / \ / / / / / /| |/ / / / | / / / / / / / / / / / / / / / / / / / / / / \ / / // // /| |/ / / // / /...

targetedKerberoast

targetedKerberoast targetedKerberoast は、他の多くのツール（例: GetUserSPNs.py）と同様に、SPN が設定されたユーザーアカウントの「kerberoast」ハッシュを出力できる Python スクリプトです。 このツールには以下の追加機能があります。SPN を持たない各ユーザーに対して、SPN を設定しようと試み（servicePrincipalName 属性への書き込み権限の悪用）、その「kerberoast」ハッシュを出力し、その操作のために設定された一時的な SPN を削除します。これは Targeted Kerberoastin...

detect_CVE-2026-25177

detect-CVE-2026-25177 生产环境安全扫描器，用于检测 CVE-2026-25177 的利用行为 —— Active Directory SPN Unicode 冲突漏洞（CVSS 8.8）。 该漏洞允许任何拥有 SPN 写入权限的已认证用户，通过向服务主体名称（SPN）中注入 Unicode 字符来将权限提升至 SYSTEM ，从而绕过 AD 的 SPN 重复校验，并导致 Kerberos 票据错误签发。 检测内容 SPN 中的 Unicode 字符 —— 零宽空格、同形异义字符、BOM 标记以及其他不可见/易混淆字符，这些均表明存在 SPN 投毒行为 跨账户的重复...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

K08602542: SAMBA vulnerability CVE-2022-0336

Security Advisory Description The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

DEBIAN-CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

CVE-2022-0336

Samba AD DC CVE-2022-0336: SPN checks can be bypassed when re-adding a previously present SPN, enabling a write-enabled attacker to impersonate services or cause DoS by matching an existing SPN. Some advisories note no patch for certain releases (e.g., Samba 4.12.5-7), while others indicate an up...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

CVE-2022-0336

The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...

CVE-2022-32743

A flaw was found in samba that validates the domain name system's host name. This issue links a trailing $ to objectclass=computer, which helps avoid the creation of SPN values that collide with other, possibly privileged hosts...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2022-1666)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Samba vfsfruit module uses extended file attributes EA, xattr to provide ...enhanced compatibility with Apple SMB clients and interoperabilit...

March 8, 2022—KB5011495 (OS Build 14393.5006) - EXPIRED

None None...

Updated samba packages fix security vulnerability

For CVE-2021-20316 and CVE-2021-44141, there is only a workaround and mitigation: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share...

Denial Of Service (DoS)

samba is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization of permission when adding service principals names SPNs to an account...