Native Windows toolkit for AD CS enumeration and exploitation. Everything runs through built-in OS components (certreq.exe, certutil.exe, PowerShell AD module, .NET Framework) - no third-party tools needed. Build with a sprinkle of FAFO and some finding out in lab env

🐥adcs-common.ps1
🐥Invoke-Enumerate.ps1
🐥Invoke-SnapshotAudit.ps1
🐥Invoke-RemoteAudit.ps1
🐥Invoke-ESC1.ps1 .. Invoke-ESC13.ps1
🐥Invoke-FindTemplates.ps1
🐥Invoke-PassTheCert.ps1
🐥Invoke-ShadowCredentials.ps1
🐥Invoke-Kerberoast.ps1
🐥Invoke-DomainRecon.ps1

This vulnerability essentially works by forcing a process running as system and that uses the undocumented function Windows_Storage!_SHCoCreateInstance, to create an arbitrary COM object of our choice. For this to happen, the object must be associated with an already registered COM class that supports CLSCTX_INPROC_SERVER. Arbitrary COM object creation is archived by manipulating a CoCreateInstance call first argument

Without further ado, I give you my take on what I’d like to call: Living off the Process! This is a technique that does as the name implies: We use what is already available to us in the remote process of our choosing to accomplish a given goal. In this case, the goal will be to write shellcode indirectly into the remote process with as low of a footprint as possible

Чтобы руками не выполнять различные запросы для поиска недостатков в инфраструктуре на базе 💻 Active Directory создан скрипт generator.py, который преобразует результаты Cypher запросов из 🐕 BloodHound в структурированные задачи для чек-листа Obsidian, позволяя автоматизировать процесс аудита безопасности 💻 Active Directory и отслеживать прогресс исправления уязвимостей

Obsidian: за гранью заметок. Генератор чек-листа

SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint

It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and therefore produces detailed reports including downloaded files and every HTTP request (Graph + SharePoint) for SIEM correlation

Большая база заметок по синтаксису PowerShell, командам Linux и инструментам DevOps на русском языке, собранная на пути от системного администратора Windows систем до DevOps инженера
Репозиторий содержит набор PowerShell и Bash скриптов, а также коллекцию стеков Docker Compose и манифестов Kubernetes, которые поддерживаются в актуальном состояние и эксплуатируется в домашней лаборатории

A simple tool for extracting information from SCCM PXE boot media
It will connect to a provided SCCM PXE server, download the boot media configuration, and try to decrypt it or output the hash for cracking

No admin privileges required

Variables File: SMSBoot\x64\pxe\variables.dat
BCD File: SMSBoot\x64\pxe\boot.bcd
Decryption Key: AB-CD-EF-...
Downloading variables file via TFTP...
File 'SMSBoot\x64\pxe\variables.dat' downloaded successfully. Size: 1234 bytes
Decrypted (Unicode): <XML content>
Management Point: http://sccm-mp.company.local
Site Code: PS1

Use SharpSCCM to get goodies!!!!
SharpSCCM.exe get secrets -i "{GUID}" -m "{MediaGUID}" -c "{PFX}" -sc PS1 -mp sccm-mp.company.local

A Windows Named Pipe Multi-tool / Proxy
Helps you observe, intercept, and replay traffic over Windows Named Pipes

from pipetap import PipeTap

tap = PipeTap()
tap.connect("pipetap.test", "10.0.0.1")

tap.send("foo\n")
print(tap.recv())

The complete red team guide to Initial Access: Payload Development (DLL Sideloading, Shellcode Loaders, Syscalls), HTML Smuggling, Phishing (QR Code Quishing, Teams Phishing), AitM/MFA Bypass (Evilginx, Device Code Phishing), Password Spraying, Exploiting Public-Facing Applications, Vishing, Physical Access (Rubber Ducky, Bash Bunny), Supply Chain attacks with real-world APT case studies

A Rust-based tool for generating DLL proxy/sideload projects for red team engagements.
Automatically parses PE export tables and generates ready-to-compile Rust projects with your payload embedded

./LazyDLLSideload.exe -m sideload -p <path_to_dll> -e <export_to_hijack>

# Relative path mode
./LazyDLLSideload.exe -m proxy -p <path_to_dll> -e <export_to_hijack> -n <renamed_dll>
# Absolute path mode
./LazyDLLSideload.exe -m proxy -p <absolute_path_to_dll> -e <export_to_hijack>

A Reflective DLL Loader for Adaptix C2 built with Crystal Palace. Features IAT hooking, Ekko-style sleep obfuscation, and per-section memory permission management

▪️ Allow changing password for locked pre2k accounts
▪️ [ShadowCopy] Add list-snapshots function for SMB & WMI
▪️ FTP module --ls flag now displays hidden files
etc

sudo apt update && sudo apt install netexec

A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory