tgt-monitor-bof

Kerberos TGT 监控与自动续期 本仓库包含两个异步 Beacon 对象文件 BOF。第一个 tgt-monitor 监控系统的 Kerberos 登录事件，并在捕获到新 Kerberos TGT 时唤醒代理。类似于 Rubeus 的 monitor 命令，该 BOF 会持续运行并定期检查 LSA 票据缓存。一旦检测到新的 TGT，它将打印票据元数据并输出 base64 编码的 kirbi 数据块，可用于通过传递票据攻击进行横向移动。第二个 tgt-renew 自动续期系统中剩余生命周期低于指定阈值（例如 15 分钟）的 TGT。 !Important 本仓库中的 BOF...

kerbrute

kerbrute 一个通过使用 Impacket 库执行 Kerberos 暴力破解的脚本。 执行时，输入接收一个用户或用户列表以及一个密码或密码列表。然后进行暴力破解攻击以枚举： 有效的用户名/密码组合 有效的用户名 不需要预认证的用户名 结果，脚本会生成发现的凭证列表，以及由这些有效凭证生成的 TGT。 安装 从 pypi： root@kitploit: pip3 install kerbrute 从仓库： root@kitploit: git clone https://github.com/TarlogicSecurity/kerbrute cd kerbrute pip...

CVE-2024-20674

CVE-2024-20674 这是我针对公开漏洞CVE-2024-20674的利用实现，利用客户端处理Kerberos U2U TGT-REP时的逻辑漏洞实现Kerberos双向认证绕过。 例如，当向客户端伪造DC时，可利用此漏洞提供任意GPO，并控制目标机器。 前提条件 ：网络中间人攻击，无需认证。 论文中漏洞的详细解释 https://www.sstic.org/2025/presentation/loutillagereseauwindowsuneaffairedimplementation/ 演示...

harpyTools

Active Directory ポストエクスプロイテーションおよびリレー自動化ユーティリティ このリポジトリには、Active Directory環境内でのセキュリティ評価とペネトレーションテストのために設計されたPythonオーケストレータースクリプトのコレクションが含まれています。これらのツールは、侵害されたワークステーションまたはサーバー上でローカル管理者アクセスが既に確立されており、広範なActive Directoryドメインに向けてラテラルムーブメントまたは権限昇格を実行することを目的とするポストエクスプロイテーションシナリオに特化して設計されています。...

pre2k

root@kitploit: /'\ /\ \ /\ /\ \ \ /'\ /\ '/'/'\ //// /\ \ , \ \ \L\ \ \ //\ //\ // /\ \ \ \\ \ \ ,/\ \\ \// // \ \ \ \ \ / // // // //// \ \ v3.0 // @unsignedsh0rt @Tw1sm Pre2k Pre2k es una herramienta para consultar la existencia de objetos de equipo pre-Windows 2000 que...

PKINITtools

PKINIT ツール このリポジトリには、PKINIT と証明書を扱うためのユーティリティが含まれています。 これらのツールは minikerberos と impacket を基に構築されています。詳細な背景については、付随するブログ記事をご覧ください: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ インストール これらのツールは Python 3.5+ でのみ互換性があります。GitHub からリポジトリをクローンし、依存関係をインストールすれば準備完了です。 root@kitploit: git clon...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/ root@kitploit: Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name...

CVE-2026-26128

CVE-2026-26128 Herramienta en Python para explotar la reflexión de Kerberos mediante la normalización Unicode en Windows Active Directory. Basada en la investigación de Guillaume André / Synacktiv. Instalación Estas herramientas solo son compatibles con Python 3.8+. Clona el repositorio desde...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fixed a possible Use-after-Allocation UAF in snictgtcreate A warning is reported as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warning: &‘tgt-list’ was not removed from the list If the deviceadd function...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS : tgt vulnerability (USN-8325-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8325-1 advisory. It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could...

USN-8325-1 tgt vulnerability

It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could possibly use this issue to make tgt generate an identical sequence of challenges, resulting in authentication bypass...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: mpi3mr: Issues in mpi3mrgetalltgtinfo have been fixed. The function mpi3mrgetalltgtinfo has four issues: 1. It calculates the valid entry length in alltgtinfo assuming that the header part of the struct mpi3mrdevicemapin...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013553 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows:...

GHSA-JF89-3Q6Q-VCGR Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the TGT credential field via the Nimbus Thrift API, due to deserialization of base64-encoded data using ObjectInputStream.readObject without class filtering or validation. A user with topology...

Apache Storm: Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2026-35337

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...