danaug23/detect_cve-2026-25177Production-safe scanner that detects CVE-2026-25177 (AD SPN Unicode Collision) exploitation on Active Directory Domain Controllers. Read-only.
Production-safe scanner that detects exploitation of CVE-2026-25177 — the Active Directory SPN Unicode Collision vulnerability (CVSS 8.8).
This vulnerability allows any authenticated user with write-SPN permissions to escalate privileges to SYSTEM by injecting Unicode characters into Service Principal Names, bypassing AD's duplicate-SPN validation and causing Kerberos ticket mis-issuance.
read_only=True; no modifications are possible(servicePrincipalName=*), the same lightweight query used by built-in tools like setspn -Qpip install -r requirements.txt
# On a domain-joined machine — auto-detects DC, domain, and username
# Prompts for password securely (never shown in terminal or command history)
python detect_spn_abuse.py
# Auto-detect with CSV report and recent change detection
python detect_spn_abuse.py --csv report.csv --days 7
# Specify just the username (auto-detect the rest)
python detect_spn_abuse.py -u svc_scanner
# Fully manual
python detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc
# Use LDAPS (port 636)
python detect_spn_abuse.py --use-ssl
Note: If you omit -p, the script prompts for your password securely — it won't appear in your terminal or command history.
+==============================================================+
| CVE-2026-25177 - SPN Unicode Collision Detector |
| Read-only scan - safe for production |
+==============================================================+
[+] Connected via NTLM:389 (read-only)
[*] Scanning all accounts with SPNs...
[+] Scanned 247 accounts, 1,042 SPNs
======================================================================
SCAN RESULTS: 1 finding(s)
CRITICAL: 1 | HIGH: 0 | INFO: 0
======================================================================
[CRITICAL] Finding 1: SPN contains 1 suspicious Unicode character(s)
────────────────────────────────────────────────────────────
Account: jsmith
DN: CN=jsmith,CN=Users,DC=corp,DC=local
SPN: HTTP/webserver.corp.local
SPN Hex: 48545450e2808b2f7765627365727665722e636f72702e6c6f63616c
Modified: 2026-03-13 14:22:17+00:00
Position 4: U+200B - Zero-Width Space [invisible]
======================================================================
RECOMMENDED ACTIONS:
1. Investigate accounts with CRITICAL findings immediately
2. Remove any SPNs containing Unicode characters
3. Check Event Log for SPN modification events (Event ID 4742)
4. Review delegation permissions (who can write SPNs)
5. Apply Microsoft patch for CVE-2026-25177
To scan daily until your DCs are patched, set up a scheduled task (Windows) or cron job (Linux):
Windows (Task Scheduler):
schtasks /create /tn "CVE-2026-25177 Scanner" /tr "python C:\path\to\detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc -p 'password' --csv C:\logs\spn_scan.csv --days 1" /sc daily /st 06:00
Linux (cron):
0 6 * * * python3 /opt/detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc -p 'password' --csv /var/log/spn_scan.csv --days 1
CVE-2026-25177 was disclosed on March 10, 2026 (CVSS 8.8). It affects all versions of Windows Server from 2012 through 2025. The attack requires only standard domain user credentials with delegated write-SPN permissions — a common configuration in enterprise environments.
Microsoft has released patches. Apply them immediately.
MIT License — free to use, modify, and distribute. See LICENSE.