HashSiphon

HashSiphon NTLM hash extraction through HTTP-layer authentication proxying, zero SSPI calls from the attacker process. HashSiphon extracts the current user's NetNTLMv2 hash by manipulating HTTP authentication flows instead of calling SSPI APIs directly. It ships two variants: v1 routes NTLM auth...

SspiUacBypass

SspiUacBypass Bypassing UAC with SSPI Datagram Contexts Full technical details at -- https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html Demo...

curl: CVE-2026-19931: Negotiate ambient user conn reuse

Summary On Windows with SSPI/Negotiate, curl 8.21.0 can reuse a connection authenticated with ambient credentials for a later request using different explicit credentials. In urlmatchauthnego, the credential comparison is skipped when conn-creds == NULL. This allows a connection authenticated as...

MiracleLinux 8 : squid:4 (AXSA:2022-3877:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3877:01 advisory. squid: buffer-over-read in SSPI and SMB authentication CVE-2022-41318 Tenable has extracted the preceding description block directly from the MiracleLinux...

EUVD-2010-0192

Malware in sbrugna...

EUVD-2016-5785

Malware in sbrugna...

SSPI Authentication Errors

Challenge In Veeam Backup & Replication When installing updates, restoring configuration, or directly interacting with the database e.g., using pgAdmin, the following error occurs: SSPI authentication failed for user In Veeam ONE When upgrading to Veeam ONE v13, the following error may occur:...

Rocky Linux 9 : squid (RLSA-2022:6839)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6839 advisory. - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer- overflow protection, the SSPI and SMB authentication helpe...

EulerOS 2.0 SP5 : squid (EulerOS-SA-2023-1515)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer- overflow protection, the SSPI and SMB...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

Integer overflow

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

Fedora 35 : squid (2022-23e6ee1fb9)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-23e6ee1fb9 advisory. - version update to 5.7. - security fixes CVE-2022-41317 Tenable has extracted the preceding description block directly from the Fedora security...

Huawei EulerOS: Security Advisory for squid (EulerOS-SA-2022-2807)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2022-2807)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed exposure of sensitive information in cache...

Rocky Linux 8 : squid:4 (RLSA-2022:6775)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6775 advisory. - A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer- overflow protection, the SSPI and SMB authentication helpe...

SolarWinds Orion Secrets Dump

This module exports and decrypts credentials from SolarWinds Orion Network Performance Monitor NPM to a CSV file; it is intended as a post-exploitation module for Windows hosts with SolarWinds Orion NPM installed. The module supports decryption of AES-256, RSA, and XMLSEC secrets. Separate action...