Coercer

다양한 방법을 통해 Windows 서버가 임의의 머신에 인증하도록 강제하는 Python 스크립트입니다. Windows 지원 Windows용 바이너리를 빌드하려면 이 저장소에서 installer.ps1 스크립트를 다운로드하세요. 인수 없이 실행하면 작업 디렉토리에 바이너리가 생성됩니다. 옵션에 대한 도움말 메뉴는 -h 또는 --help를 사용하세요. 기능 코어: 원격 머신의 열린 SMB 파이프 목록을 나열합니다 모드 스캔 인증 및 퍼징 인증 원격 머신의 알려진 SMB 파이프 목록에 연결을 시도합니다 모드 스캔 미인증 및 퍼징 미...

PetitPotam

PetitPotam MS-EFSRPC EfsRpcOpenFileRaw 또는 다른 기능을 통해 Windows 호스트가 다른 머신에 인증하도록 강제하는 PoC 도구 : 이 도구는 더 널리 사용되는 인터페이스 c681d488-d850-11d0-8c52-00c04fd90f7e의 LSARPC 명명된 파이프를 사용합니다. 그러나 EFSRPC 명명된 파이프와 인터페이스 df1941c5-fe89-4e79-bf10-463657acf44d로도 트리거할 수 있습니다. 도메인 컨트롤러에 대한 자격 증명이 필요하지 않습니다 :D EFS 서비스를...

CVE-2026-73005

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

EUVD-2026-73767

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

Windows Authentication Methods Elevation of Privilege Vulnerability

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...

windows-coerced-authentication-methods

このリポジトリには、Windowsマシンに対し、攻撃者が制御するマシンへの認証を強制する多くの方法のリストが含まれています。 これらの方法はすべて、ドメイン内の標準ユーザーが、対象のWindowsマシン（通常はドメインコントローラー）のマシンアカウントに、任意のターゲットへの認証を強制するために呼び出すことができます。これらの各方法におけるこの「脆弱性/機能」の根本原因は、WindowsマシンがUNCパス（\192.168.2.1\SYSVOL\file.txt など）にアクセスしようとする際に、他のマシンへ自動的に認証を行うことです。 現在、5 つのプロトコルで 15...

Astra Linux – Vulnerability in exim4

Exim NTLM Challenge Out-of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the handling of NTLM...

CVE-2026-57288

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native ADSI authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a...

CVE-2026-56968

CVE-2026-56968 affects GNU SASL versions prior to 2.2.4. The NTLM client’s short challenge in the function _gsasl_ntlm_client_step has inadequate sanitization, which can lead to memory disclosure when interacting with a crafted server. Public sources (SUSE, Debian OSV, Ubuntu/Ubuntu-related advis...

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT default 10 hours and decrypt or forge any subsequent WS‑SecureConversation traffic that uses...

GHSA-WQP7-X3PW-XC5R Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...

EUVD-2026-36725

Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...

PT-2026-49575

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1 Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC Universal Naming Convention paths. On Windows systems, accessing a UNC path triggers an automatic NTLM...

CVE-2026-50508

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-50508 Windows NTLM Spoofing Vulnerability

...

CVE-2026-50508 Windows NTLM Spoofing Vulnerability

...

CVE-2026-50508

CVE-2026-50508 describes an exposure of sensitive information in Windows NTLM that enables an unauthenticated network-based spoofing capability. The vulnerability affects the Windows NTLM authentication path and is documented with a network attack vector and a high confidentiality impact. Public ...

Windows NTLM Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

PT-2026-48124

Name of the Vulnerable Software and Affected Versions Windows NTLM affected versions not specified Description Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an attacker to perform spoofing over a network, which can affect the system. Recommendations At the...

CVE-2026-8993

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...