NetNTLMtoSilverTicket

SpoolSample - NetNTLMv1 - NTLM - Silver Ticket 这项技术曾被其他人提及，但我尚未看到任何完整的资料。下面我们将逐步介绍如何获取 NetNTLMv1 挑战/响应认证，破解这些认证为 NTLM 哈希，并使用该 NTLM 哈希来签署 Kerberos Silver Ticket。 这适用于“LAN Manager 身份验证级别”设置为 2 或以下的网络。这是较旧、较大型 Windows 部署中相当常见的情况。在 Windows 10 / Server 2016 或更新版本上应该不起作用。 主要有 3 个步骤 通过 @tifkin Lee...

DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method

PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot method and probably more but am lazy and its just PoC :P . Documentation: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Inspired by: PetitPotam @topotam77...

MultiPotato - Another Potato to get SYSTEM via SeImpersonate privileges

First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the code can be...

Exploit for CVE-2021-1678

PoC exploit for CVE-2021-1678, an arbitrary code execution vulnerability in the Windows Print Spooler service. The exploit is contained within a Docker container, which can be built and run using the provided Dockerfile. The container includes a Python script, spoolsploit.py, that can be used to...