Proof-of-concept module for CVE-2026-54121 (Certighost), exploiting AD CS enrollment validation via rogue LDAP/SMB listeners to impersonate a Domain…
parrotsec/mimikatzTool for extracting Windows credentials (passwords, hashes, Kerberos tickets) from memory and performing pass-the-hash, pass-the-ticket, and golden…
temp43487580/entrapassthecerttool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with it
jarnovandenbrink/getspnlessPython tool to automatically perform SPN-less RBCD attacks.
s3cur3th1ssh1t/sharpnamedpipepthPass the Hash to a named pipe for token Impersonation
mayyhem/sharpsccmC# post-exploitation tool for abusing Microsoft Configuration Manager (SCCM) to perform lateral movement, credential gathering, and NTLM…
secureworks/squarephishAdvanced phishing tool combining OAuth Device Code authentication flow with QR codes to harvest Microsoft authentication tokens via MFA update…
ghostpack/rubeusTrying to tame the three-headed dog.
zimedev/certipy-mergedTool for Active Directory Certificate Services enumeration and abuse
oriyomi12/otp-botAutomates vishing calls via Discord bot and API to intercept SMS one-time passwords, bypassing SMS verification for PayPal, Google, Instagram, and 3D…
mzhmo/powershellkerberosSome scripts to abuse kerberos using Powershell
ricardojoserf/autopttAutomated Pass-the-Ticket (PtT) attack. Standalone alternative to Rubeus and Mimikatz for this attack. In C#, C++, Crystal, Python, Rust, Golang, Nim…
s3cur3th1ssh1t/namedpipepthPass the Hash to a named pipe for token Impersonation
kindtime/nosferatuDLL that hooks NTLM and Kerberos authentication in lsass.exe to inject a backdoor hash, enabling persistent authenticated access on Windows systems.
jakobfriedl/tgt-monitor-bofAsync BOF to automatically extract or renew Kerberos TGTs on a target system.
synacktiv/invoke-runaswithcertA PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.
morrubin/negoexrelayRelays NegoEx/PKU2U Kerberos authentication to arbitrary targets, enabling credentialless authentication, command execution, SMB hash dumping, and…
sanupl/cve-2021-46067CVE-2021-46067 - In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.