101 matches found
ms-photos_NTLM_Leak
Microsoft ms-photos URI NTLM 泄露 新漏洞允许通过一次点击从浏览器泄露NTLM哈希 作者：Ruben Enkaoua 描述 Microsoft ms-photos URI 方案将 fileName 作为参数，该参数可以提交带有 UNC 路径，在打开时泄露 NTLMv2-SSP 哈希。通过构造一个特殊格式的链接，攻击者可以强迫受害者直接从浏览器启动 Microsoft Photos 应用。当触发时，此行为会导致受害者的 NTLMv2-SSP...
DragonCastle
DragonCastle AutodialDLLの横展開テクニックとSSPを組み合わせて、LSASSプロセスからNTLMハッシュを抽出するPoCです。 説明 ターゲットマシンにDLLをアップロードします。次に、リモートレジストリを有効にしてAutodialDLLエントリを変更し、BITSサービスを開始/再起動します。SvchostsはDLLをロードし、AutodialDLLをデフォルト値に戻してから、RPCリクエストを実行してLSASSに同じDLLをSecurity Support...
CVE-2013-2028-x64-bypass-ssp-and-pie-PoC
用于绕过 NX PIE SSP ASLR 这个PoC不稳定。 有时HTTP服务会宕机。 你应该修复morecore-offset并选择正确的libc-file。...
CVE-2025-24054
Windows ファイルエクスプローラ ゼロクリック NTLMv2-SSP ハッシュ開示 🎥 実証POC + 2025年3月パッチバイパス 🎥 パッチバイパス 上記の画像をクリックすると脆弱性のデモが再生されます 📋 技術概要 このリポジトリは、Windows Shell のファイル形式処理における脆弱性連鎖を分析し、NTLMv2-SSP 資格情報の開示に至る包括的な研究フレームワークを提供します。このツールキットは、Windows エクスプローラのファイルプレビュー操作中に自動 UNC パス解決を悪用する、2 つの異なる攻撃ベクトルを実装しています。 中核となる脆弱性メカニズム...
CVE-2025-50154-Aggressor-Script
LNK Weaponizer - Cobalt Strike Aggressor 脚本 一个全面的 Cobalt Strike Aggressor 脚本，用于武器化并执行恶意 LNK 文件和 Library-MS 文件，以泄露 SMB NTLMv2-SSP 哈希。包含 CVE-2025-24054 绕过技术。 ⚠️ 免责声明 此工具仅用于教育和研究目的。作者对任何滥用此代码的行为不承担任何责任。仅在你拥有或明确获准测试的系统上使用。 捕获 NTLM 哈希 该脚本生成武器化的 .lnk 和 .library-ms 文件，当打开时会触发向操作者主机的 SMB 身份验证。 泄露的 NTLMv2...
CVE-2024-38063
CVE-2024-38063 - SSP H3 对于这个设置（来自视频的那个），我使用了 Windows 22H2 19045 和 build 2468。（这个 CVE 直到 4780 才被修补） 我在 Qemu/KVM 上尝试过，但网卡没有合并数据包（根据我用 tcpdump 调查的结果）。解决方案是使用 VirtualBox 的 Host-Only 网络。 我尝试了几个 PoC（巧干而非蛮干）： https://github.com/ThemeHackers/CVE-2024-38063...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
RHEL 8 : kernel (RHSA-2026:65709)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65709 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcievent: fix...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, exists within the Secure Simple Pairing SSP passkey handlers. It occurs when hciconn lookup and field access are performed without proper locking, allowing a connection to be freed concurrently...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a memory leak in setsspcomplete. The memory leak was fixed in setsspcomplete, where the mgmtpendingcmd structures are not freed after they are removed from the pending list. Commit 302a1f674c00 “Bluetoot...
CVE-2026-46056
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...
CVE-2026-46056
The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: cifs: A memory leak occurs when the build ntlmssp negotiate blob operation fails. There is a memory leak when mounting CIFS shares: - Unreferenced object: 0xffff888166059600 size 448 Command: “mount.cifs”, PID: 51391, Jiffies:...
SUSE CVE-2026-23151
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...
CVE-2026-23151
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...
UBUNTU-CVE-2026-23151
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...
CVE-2026-23151
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...