UnCanny

UNCanny Coerce La idea detrás de esta investigación era simple, ya que quería encontrar mi propia técnica de coerción. Empecé buscando nuevas superficies de ataque RPC, pero después de que Microsoft agregó monitoreo de actividad RPC...

CVE-2022-39838

CVE-2022-39838 Suggested description Systematica FIX Adapter ALFAFX 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pathnames. Additional Information PoC:...

CVE-2025-33053-Checker-PoC

CVE-2025-33053 Vulnerability Checker & Proof-of-Concept PoC Checker Proof PoC Proof A complete set of tools to check and demonstrate potential exploitation of CVE-2025-33053 , a critical WebDAV-based Remote Code Execution RCE vulnerability affecting Windows systems. 📌 About CVE-2025-33053...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2023-23397

CVE-2023-23397 Una prueba de concepto para CVE-2023-23397 para pruebas de seguridad. Modifique las líneas 11 y 12 con la ruta UNC del atacante y la dirección de correo electrónico objetivo...

CVE-2023-23397

CVE-2023-23397 CVE-2023-23397 C PoC 1- download the msgkit 2- edit the appointment class and add the below: 3- create a new class inside the project to set the proprieties of the msg file: root@kitploit: using MsgKit.Enums; using System; using System.Collections.Generic; using System.Linq; using...

CVE-2023-23397

Un PoC simple en PowerShell para CVE-2023-23397 CVE-2023-23397 es una vulnerabilidad en MS Outlook que permite a un atacante potencialmente exfiltrar detalles de autenticación del usuario. La vulnerabilidad se relaciona con la capacidad de un atacante de especificar una ruta UNC en la propiedad...

CVE-2022-26809

CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...

SMBRat

SMBRat A Windows Remote Administration Tool in Visual Basic Script Idea Windows Environments like Active Directory Networks, get really bloated with SMB traffic. All hosts get Policies from the SYSVOL , configurations need remote files to work, desktop shortcuts tend to point to...

doctrack

Doctrack Herramienta para manipular y armamentizar documentos Office Open XML. Características Crear documentos Office Open XML Word, Excel Insertar píxeles de seguimiento y rutas UNC Inyección de plantilla remota Insertar partes CustomXML Inspeccionar URLs de destino externas, metadatos y partes...

Cve-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point:...

CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient

CVE-2024-40586 Autenticación Coaccionada de Windows en FortiClient En sistemas Windows, se encontró que FortiClient versión de la aplicación 7.0.8.0427 permite a un usuario remoto sin privilegios coaccionar a los hosts de Windows para que se autentiquen en otras máquinas a través de una tubería c...

CVE-2026-22444

CVE-2026-22444 Apache Solr UNC Path Validation Vulnerability Overview CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation CWE-20: Improper Input Validation on certain API parameter...

CVE-2023-23397-PoC

CVE-2023-23397-PoC C send only version of CVE-2023-23397-POC-Powershell by Oddvar Moe @oddvarmoe Sends email from the address associated with Outlook account. root@kitploit: .\CVE202323397.exe --help CVE202323397 1.0.0.0 Copyright c 2023 -t, --to Required. Recipient email address -p, --path...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

CVE-2025-24054

Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure 🎥 Demonstration POC + March 2025 Patch bypass 🎥 patch bypass Click the image above to watch the vulnerability demonstration 📋 Technical Overview This repository provides a comprehensive research framework analyzing the vulnerability chai...

CVE-2023-23397

CVE-2023-23397 Exploitation & Mitigation Demo 📌 Descripción general Este proyecto demuestra la detección, explotación y mitigación de CVE-2023-23397 , una vulnerabilidad crítica de retransmisión NTLM de cero clics en Microsoft Outlook para Windows. Explotada mediante invitaciones de calendario,...

CVE-2023-23397-Report

CVE-2023-23397-Report An exploitation demo of Outlook Elevation of Privilege Vulnerability CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB TCP 445 share on a threat...

windows-coerced-authentication-methods

This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...

PoC-CVE-2025-24071

❀ coerce-library CVE-2025-24071 — .library-ms NTLM coercion SMB / TAR method ❀ What it does Asks for your attack IP and a file name , writes a .library-ms pointing at \\share, and packs it into exploit.tar. When Explorer browses the folder the loose .library-ms lands in, it auto-resolves that UNC...