Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
metasploit-ldapnightmare — SafeBreaches CVE-2024-49113 POC(LdapNightmare) Integrated into Metasploit | Kitploit
Tools/GitHubGitHub/0xmetr0/metasploit-ldapnightmare
Penetration Testing FrameworksExploit FrameworksVulnerability AnalysisExploitationPayload Development
GitHub0xmetr0/metasploit-ldapnightmare

metasploit-ldapnightmare

SafeBreaches CVE-2024-49113 POC(LdapNightmare) Integrated into Metasploit

View Repository
391 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

metasploit-ldapnightmare

SafeBreaches CVE-2024-49113 POC(LdapNightmare) Integrated into Metasploit

Overview

This module implements CVE-2024-49113, a critical vulnerability in the Windows LDAP client that can cause system instability. The module integrates with the Metasploit Framework, providing a reliable way to test system resilience against this vulnerability.

Features

  • Full Metasploit Framework integration
  • Asynchronous LDAP server implementation
  • Configurable parameters for testing different scenarios
  • Detailed logging and status reporting
  • Built-in safety checks and dependency verification

Requirements

  • Python 3.5 or newer
  • Metasploit Framework
  • Required Python packages:
    root@kitploit:~
    ldaptor
impacket

Installation

  1. Install the required Python packages:

    root@kitploit:~
    pip install -r requirements.txt

  2. Place the module in your Metasploit modules directory:

root@kitploit:~
cp ldapnightmare.py /path/to/metasploit/modules/auxiliary/dos/windows/ldap/

  • Ensure the module is executable:

    root@kitploit:~
    chmod +x ldapnightmare.py

    • Usage

    Within Metasploit Framework:

    1. Start msfconsole:

      root@kitploit:~
      msfconsole

    2. Load and configure the module:

      root@kitploit:~
      use auxiliary/dos/windows/ldap/ldapnightmare
set RHOSTS target_ip
set RPORT 49664
set LPORT 389
set DOMAINNAME yourdomain.com
run

    Configuration Options

    • RHOSTS - Target address (required)
    • RPORT - Target port for RPC (default: 49664)
    • LPORT - Local port for LDAP server (default: 389)
    • DOMAINNAME - Attacker's domain name (required). This domain must have specific DNS SRV records configured (see Domain Configuration below)
    • ACCOUNT - Target account name (default: Administrator)
    • SITENAME - Target site name (default: empty)

    Domain Configuration

    The DOMAINNAME parameter requires specific DNS SRV records to be configured. The domain must have two SRV records under it:

    1. ldap.tcp.dc._msdcs.domain_name → listen_port attacker's_machine_hostname
    2. ldap.tcp.default-first-site-name._sites.dc._msdcs.domain_name → listen_port attacker's_machine_hostname

    Important Note: The attacker's machine hostname will work only if the victim server can resolve it using NBNS. Alternatively, you can replace the hostname with a domain name that points to the IP address of your LDAP server.

    Technical Details

    The module operates in three main stages:

    1. Sets up an asynchronous LDAP server to handle incoming connections
    2. Initiates a DsrGetDcNameEx2 RPC call to trigger LDAP client behavior
    3. Sends a specially crafted LDAP response to demonstrate the vulnerability

    Credits

    • Original Research: SafeBreach Labs
    • Authors: Or Yair, Shahak Morag
    • Metasploit Integration: 0xMetr0

    References

    • SafeBreach Labs CVE-2024-49113 Research
    • CVE-2024-49113 Details

    Disclaimer

    This module is intended for authorized security testing and research purposes only. Users must obtain proper authorization before testing any systems they don't own or have permission to test.

    License

    This module is released under the BSD 3-Clause License.

    This work contains code derived from:

    • SafeBreach Labs' original PoC (BSD 3-Clause License)
    • Metasploit Framework (MSF_LICENSE - BSD 3-Clause License)

    Full license texts can be found in the LICENSES file.

    Download Tool