282 matches found
PetitPotam
PetitPotam MS-EFSRPC EfsRpcOpenFileRaw 또는 다른 기능을 통해 Windows 호스트가 다른 머신에 인증하도록 강제하는 PoC 도구 : 이 도구는 더 널리 사용되는 인터페이스 c681d488-d850-11d0-8c52-00c04fd90f7e의 LSARPC 명명된 파이프를 사용합니다. 그러나 EFSRPC 명명된 파이프와 인터페이스 df1941c5-fe89-4e79-bf10-463657acf44d로도 트리거할 수 있습니다. 도메인 컨트롤러에 대한 자격 증명이 필요하지 않습니다 :D EFS 서비스를...
Coercer
다양한 방법을 통해 Windows 서버가 임의의 머신에 인증하도록 강제하는 Python 스크립트입니다. Windows 지원 Windows용 바이너리를 빌드하려면 이 저장소에서 installer.ps1 스크립트를 다운로드하세요. 인수 없이 실행하면 작업 디렉토리에 바이너리가 생성됩니다. 옵션에 대한 도움말 메뉴는 -h 또는 --help를 사용하세요. 기능 코어: 원격 머신의 열린 SMB 파이프 목록을 나열합니다 모드 스캔 인증 및 퍼징 인증 원격 머신의 알려진 SMB 파이프 목록에 연결을 시도합니다 모드 스캔 미인증 및 퍼징 미...
Telerik UI for ASP.NET AJAX 2008.3.1314 < 2026.2.708 RadEditor PDF Export SSRF
The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2008.3.1314 or later and prior to 2026.2.708. It is, therefore, affected by a server-side request forgery vulnerability. Insufficient validation of content submitted to the RadEditor PDF export feature may...
windows-coerced-authentication-methods
This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...
Astra Linux – Vulnerability in exim4
Exim NTLM Challenge Out-of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the handling of NTLM...
CVE-2026-73005
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
EUVD-2026-73767
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
Windows Authentication Methods Elevation of Privilege Vulnerability
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
PT-2026-87914
Name of the Vulnerable Software and Affected Versions Windows Authentication Methods affected versions not specified Description A use after free issue in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that...
CVE-2026-73005: Use After Free
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
CVE-2026-13192: Server-Side Request Forgery (SSRF)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...
CVE-2026-57288
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native ADSI authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a...
LDAP injection vulnerability in active-directory
In active-directory 2.41.1 and earlier, the Windows native ADSI authentication path does not escape the user name before building the LDAP search filter. This allows unauthenticated attackers to inject LDAP wildcard characters into the user name, enabling them to enumerate directory user and grou...
CVE-2026-56968
CVE-2026-56968 affects GNU SASL versions prior to 2.2.4. The NTLM client’s short challenge in the function _gsasl_ntlm_client_step has inadequate sanitization, which can lead to memory disclosure when interacting with a crafted server. Public sources (SUSE, Debian OSV, Ubuntu/Ubuntu-related advis...
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT default 10 hours and decrypt or forge any subsequent WS‑SecureConversation traffic that uses...
GHSA-WQP7-X3PW-XC5R Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...
EUVD-2026-36725
Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...
PT-2026-49575
Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1 Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC Universal Naming Convention paths. On Windows systems, accessing a UNC path triggers an automatic NTLM...
