CVE-2022-26809

This repository describes a honeypot mechanism targeting red team members using mobile hotspots, focusing on tracing attackers by capturing their phone numbers via JavaScript. It includes details on detecting debug modes and Burp Suite vulnerabilities, along with a list of APIs used for tracing.

This PoC exploits CVE-2022-26809, an integer overflow vulnerability in the RPC runtime library, by sending maliciously crafted DCERPC packets to trigger a denial-of-service (DoS) condition. It overrides Impacket's transport functions to manipulate packet fragmentation and alloc hints, leading to a crash in the target system.

This repository contains a working PoC for CVE-2022-26809, which coerces NTLM authentication from Windows hosts via EFS-RPC. The exploit leverages multiple methods in the EFS protocol to force authentication to an attacker-controlled SMB server.

This repository provides detection logic for CVE-2022-26809, a remote code execution vulnerability in DCE/RPC. It includes Zeek scripts to generate notices for exploit attempts and successful exploitation.

The repository contains a README detailing CVE-2022-26809, an RPC vulnerability in Windows, but the exploit.py file is a non-functional stub with no working exploit code. The author notes the PoC is still in development.

This repository is a placeholder for a future PoC for CVE-2022-26809, an RCE vulnerability in Microsoft RPC. It currently contains no functional exploit code, only a README indicating intent to provide a one-click RCE.

This is a Python-based exploit for CVE-2022-26809 (PrintNightmare), which leverages the MS-RPRN protocol to achieve remote code execution by adding a malicious printer driver. The exploit interacts with the Windows Print Spooler service to stage and execute arbitrary DLLs.

This repository contains a proof-of-concept exploit for CVE-2022-26809, a vulnerability in the Windows RPC runtime library (rpcrt4.dll). The exploit triggers an integer overflow in the `OSF_CASSOCIATION::ProcessBindAckOrNak` function by sending a specially crafted RPC request, similar to the exploitation method used in CVE-2021-43893.

The repository claims to be a PoC for CVE-2022-26809 but only contains a README with a link to an external payment site, which is highly unusual for legitimate exploit PoCs.

This repository claims to be a PoC for CVE-2022-26809 (RPC-based RCE in Windows) but contains non-functional code with a disclaimer stating it does not work. The script attempts to bind to the Spooler service but lacks proper exploit logic.