RemotePotato — Updated version (Cross session activation)
https://github.com/antonioCoco/RemotePotato0
#windows #privesc #lpe #pentest
https://github.com/antonioCoco/RemotePotato0
#windows #privesc #lpe #pentest
GitHub
GitHub - antonioCoco/RemotePotato0: Windows Privilege Escalation from User to Domain Admin.
Windows Privilege Escalation from User to Domain Admin. - antonioCoco/RemotePotato0
EfsPotato
Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).
https://github.com/zcgonvh/EfsPotato
#windows #privesc #pentest
Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).
https://github.com/zcgonvh/EfsPotato
#windows #privesc #pentest
GitHub
GitHub - zcgonvh/EfsPotato: Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation…
Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability). - zcgonvh/EfsPotato
📜 Abuse AD CS via dNSHostName Spoofing
This blog covers the technical details of CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability via AD CS dNSHostName Spoofing.
https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4
When you have SYSTEM on server/workstation:
https://gist.github.com/Wh04m1001/355c0f697bfaaf6546e3b698295d1aa1
#ad #adcs #privesc #redteam
This blog covers the technical details of CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability via AD CS dNSHostName Spoofing.
https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4
When you have SYSTEM on server/workstation:
https://gist.github.com/Wh04m1001/355c0f697bfaaf6546e3b698295d1aa1
#ad #adcs #privesc #redteam
APT
📜 Abuse AD CS via dNSHostName Spoofing This blog covers the technical details of CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability via AD CS dNSHostName Spoofing. https://research.ifcr.dk/certifried-active-directory-domain…
🛠 DNSHostName Spoofing combined with KrbRelayUp
Domain user to domain admin without the requirement for adding/owning previously a computer account. Step-by-step write-up of the attack in a pure Windows environment.
https://gist.github.com/tothi/f89a37127f2233352d74eef6c748ca25
#ad #adcs #privesc #ldap #relay #redteam
Domain user to domain admin without the requirement for adding/owning previously a computer account. Step-by-step write-up of the attack in a pure Windows environment.
https://gist.github.com/tothi/f89a37127f2233352d74eef6c748ca25
#ad #adcs #privesc #ldap #relay #redteam
Gist
Certifried combined with KrbRelayUp: non-privileged domain user to Domain Admin without adding/pre-owning computer accounts
Certifried combined with KrbRelayUp: non-privileged domain user to Domain Admin without adding/pre-owning computer accounts - certifried_with_krbrelayup.md
🔥4
APT
KrbRelayUp Universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings) https://github.com/Dec0ne/KrbRelayUp #ad #privesc #kerberos #ldap #relay
⚙️ No-Fix LPE Using KrbRelay with Shadow Credentials
This article will explain how to separate the shadow credential method that KrbRelayUp uses into multiple different steps, giving you a bit more control regarding how each piece executes. For example, we can reflectively load some pieces, and execute others normally
https://icyguider.github.io/2022/05/19/NoFix-LPE-Using-KrbRelay-With-Shadow-Credentials.html
#ad #privesc #kerberos #relay
This article will explain how to separate the shadow credential method that KrbRelayUp uses into multiple different steps, giving you a bit more control regarding how each piece executes. For example, we can reflectively load some pieces, and execute others normally
https://icyguider.github.io/2022/05/19/NoFix-LPE-Using-KrbRelay-With-Shadow-Credentials.html
#ad #privesc #kerberos #relay
🔥4👍1
APT
📜 Abuse AD CS via dNSHostName Spoofing This blog covers the technical details of CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability via AD CS dNSHostName Spoofing. https://research.ifcr.dk/certifried-active-directory-domain…
📜 Defused That SAN Flag
One more post about Microsoft's recent security updates - re changes to Kerberos and the new certificate extension containing the requester's SID.
The changes 'defuse' the impact of the flag that allows adding custom subject alternative names to any certificate (including the ones that 'actually' should be auto-enrolled).
https://elkement.blog/2022/06/13/defused-that-san-flag/
#ad #adcs #privesc #redteam
One more post about Microsoft's recent security updates - re changes to Kerberos and the new certificate extension containing the requester's SID.
The changes 'defuse' the impact of the flag that allows adding custom subject alternative names to any certificate (including the ones that 'actually' should be auto-enrolled).
https://elkement.blog/2022/06/13/defused-that-san-flag/
#ad #adcs #privesc #redteam
👍2
Forwarded from Волосатый бублик
#ad #rpc #ntlm #privesc
[ Coercer ]
atricle: https://github.com/p0dalirius/windows-coerced-authentication-methods
There is currently 15 known methods in 5 protocols.
tool: https://github.com/p0dalirius/Coercer
A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
[ Coercer ]
atricle: https://github.com/p0dalirius/windows-coerced-authentication-methods
There is currently 15 known methods in 5 protocols.
tool: https://github.com/p0dalirius/Coercer
A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
👍2👎1
⚔️ DirCreate2System
Weaponizing to get NT AUTHORITY\SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting
https://github.com/binderlabs/DirCreate2System
#windows #privesc #directory #error #report
Weaponizing to get NT AUTHORITY\SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting
https://github.com/binderlabs/DirCreate2System
#windows #privesc #directory #error #report
🔥6👍1
🦛 PetitPotam: Local Privilege Escalation
Now PetitPotato can elevate to SYSTEM on the latest windows.
My test version is 10.0.20348.1547
https://github.com/wh0amitz/PetitPotato/
#windows #privesc #rpc #petitpotam
Now PetitPotato can elevate to SYSTEM on the latest windows.
My test version is 10.0.20348.1547
https://github.com/wh0amitz/PetitPotato/
#windows #privesc #rpc #petitpotam
👍8
This media is not supported in your browser
VIEW IN TELEGRAM
🍅 S4UTomato — Escalate Service Account To LocalSystem via Kerberos
Learn how to leverage Kerberos for privilege escalation in a Windows domain environment using virtual accounts with the help of Resource-based Constrained Delegation, Shadow Credentials, and Tgtdeleg techniques.
https://github.com/wh0amitz/S4UTomato
#ad #privesc #kerberos #windows
Learn how to leverage Kerberos for privilege escalation in a Windows domain environment using virtual accounts with the help of Resource-based Constrained Delegation, Shadow Credentials, and Tgtdeleg techniques.
https://github.com/wh0amitz/S4UTomato
#ad #privesc #kerberos #windows
🔥5👍1
📄 ADCS: New Ways to Abuse ManageCA Permissions
The Certsrv service exhibits a race condition during the creation of CRL files, any standard user with ManageCA ACL and publish the CDP and carry out arbitrary file movements, ultimately leading to domain elevation of privileges.
🔗 https://whoamianony.top/posts/ad-cs-new-ways-to-abuse-manageca-permissions/
#ad #adcs #manageca #privesc
The Certsrv service exhibits a race condition during the creation of CRL files, any standard user with ManageCA ACL and publish the CDP and carry out arbitrary file movements, ultimately leading to domain elevation of privileges.
🔗 https://whoamianony.top/posts/ad-cs-new-ways-to-abuse-manageca-permissions/
#ad #adcs #manageca #privesc
🔥9❤🔥1👍1
298559809-27f286d7-e0e3-47ab-864a-e040f8749708.mp4
1.2 MB
This vulnerability targets the Common Log File System (CLFS) and allows attackers to escalate privileges and potentially fully compromise an organization’s Windows systems. In April 2023, Microsoft released a patch for this vulnerability and the CNA CVE-2023-28252 was assigned.
📊 Affects version:
— Windows 11 21H2 (clfs.sys version 10.0.22000.1574);
— Windows 11 22H2;
— Windows 10 21H2;
— Windows 10 22H2;
— Windows Server 2022.
Research:
🔗 https://www.coresecurity.com/core-labs/articles/analysis-cve-2023-28252-clfs-vulnerability
Exploit:
🔗 https://github.com/duck-sec/CVE-2023-28252-Compiled-exe
#windows #privesc #clfs #driver
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥10