286 matches found
CVE-2023-23397
CVE-2023-23397 A proof of concept for CVE-2023-23397 for security testing. Modify lines 11 and 12 with the attacker UNC path and target email address...
CVE-2023-23397
A Simple PoC in PowerShell for CVE-2023-23397 CVE-2023-23397 is a vulnerability in MS Outlook that allows an attacker to potentially exfil user authentication details. The vulnerability relates to the the ability for an attacker to specify a UNC path in the "ReminderSoundFile" property within an...
UnCanny
UNCanny Coerce The idea behind this research was simple as i wanted to find my own coercion technique. i started by looking for new RPC attack surfaces, but after microsoft added RPC activity monitoring...
Cve-2022-26809
Cve-2022-26809 CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point:...
CVE-2023-23397-PoC
CVE-2023-23397-PoC C send only version of CVE-2023-23397-POC-Powershell by Oddvar Moe @oddvarmoe Sends email from the address associated with Outlook account. root@kitploit: .\CVE202323397.exe --help CVE202323397 1.0.0.0 Copyright c 2023 -t, --to Required. Recipient email address -p, --path...
doctrack
Doctrack Herramienta para manipular y armamentizar documentos Office Open XML. CaracterΓsticas Crear documentos Office Open XML Word, Excel Insertar pΓxeles de seguimiento y rutas UNC InyecciΓ³n de plantilla remota Insertar partes CustomXML Inspeccionar URLs de destino externas, metadatos y partes...
CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient
CVE-2024-40586 Windows Coerced Authentication in FortiClient On Windows system, it was found that FortiClient App version 7.0.8.0427 allow a remote unprivileged user to coerce Windows hosts authenticate to other machines via a named pipe responsible for FortiSSLVPNdaemon service. It was observed...
CVE-2022-26809
CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...
ms-photos_NTLM_Leak
Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...
OutlookNTLM_CVE-2023-23397
To exploit this vulnerability, an attacker must create a malicious calendar invitation that includes a reference to a sound file pointing to a file in a network share in the attacker's machine. At a low level, an Outlook email stores the reference to the sound file in an internal parameter called...
SMBRat
SMBRat A Windows Remote Administration Tool in Visual Basic Script Idea Windows Environments like Active Directory Networks, get really bloated with SMB traffic. All hosts get Policies from the SYSVOL , configurations need remote files to work, desktop shortcuts tend to point to...
CVE-2023-23397
CVE-2023-23397 CVE-2023-23397 C PoC 1- download the msgkit 2- edit the appointment class and add the below: 3- create a new class inside the project to set the proprieties of the msg file: root@kitploit: using MsgKit.Enums; using System; using System.Collections.Generic; using System.Linq; using...
CVE-2022-39838
CVE-2022-39838 Suggested description Systematica FIX Adapter ALFAFX 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pathnames. Additional Information PoC:...
CVE-2020-13941
CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr Multiple Solr endpoints have been found to accept absolute paths. In Windows systems these absolute path can be forced to make the OS connect to an attacker-controlled SMB server. This behaviour may result in attacks such as...
CVE-2025-33053-Checker-PoC
CVE-2025-33053 Vulnerability Checker & Proof-of-Concept PoC Checker Proof PoC Proof A complete set of tools to check and demonstrate potential exploitation of CVE-2025-33053 , a critical WebDAV-based Remote Code Execution RCE vulnerability affecting Windows systems. π About CVE-2025-33053...
CVE-2023-23397
CVE-2023-23397 Vulnerability Details π¨π» Microsoft has recently addressed a set of critical security vulnerabilities, including this zero-day exploits: CVE-2023-23397. The Common Vulnerability Scoring System CVSS assigned score of 9.8 to this exploit. CVE-2023-23397: Elevation of Privilege in...
cve-2025-24071
CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. β οΈ This is for educational and research purposes only. Do not use this on production...
CVE-2025-24054
Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure π₯ Demonstration POC + March 2025 Patch bypass π₯ patch bypass Click the image above to watch the vulnerability demonstration π Technical Overview This repository provides a comprehensive research framework analyzing the vulnerability chai...
CVE-2026-32202
Disclaimer This tool is for authorized red teaming and penetration testing only. Unauthorized use against systems without explicit permission is illegal. Use at your own risk. The author assumes no liability for any misuse or damage. Description NTLMv2 hash coercion via incomplete Windows Shell...
CVE-2023-23397
CVE-2023-23397 Exploitation & Mitigation Demo π Overview This project demonstrates the detection, exploitation, and mitigation of CVE-2023-23397 , a critical zero-click NTLM relay vulnerability in Microsoft Outlook for Windows. Exploited via calendar invites, this vulnerability allows attackers t...