relay_bible

Relay Bible — Internal Penetration Testing Relay Guide A comprehensive reference for NTLM relay attacks during authorized internal penetration tests. Covers authentication fundamentals, coercion techniques, per-protocol relay targets, tooling, advanced chaining, and defensive mitigations...

ldap_shell

LDAP shell This project is a fork of ldapshell from Impacket. It provides an interactive shell for Active Directory enumeration and manipulation via LDAP/LDAPS protocols, making it useful for both system administrators and security professionals. Installation These tools are only compatible with...

kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

gssapi-abuse

gssapi-abuse gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directo...

pentest-book

description: - This book contains a bunch of info, scripts and knowledge used during my pentests. /home/six2dez/.pentest-book Thanks to visit this site, please consider enhance this book with some awesome tools or techniques you know, you can contact me by Telegram@six2dez, Twitter@six2dez1 or...

WindowsProtocolTestSuites

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

lsawhisper-bof

LSA Whisperer BOF Un puerto de Cobalt Strike Beacon Object File BOF de LSA Whisperer — la herramienta que habla directamente con los paquetes de autenticación de Windows a través de la interfaz de cliente no confiable/confiable de LSA, sin tocar la memoria del proceso LSASS incluso cuando PPL y...

tgt-monitor-bof

Monitorización y Renovación Automática de TGTs Kerberos Este repositorio contiene dos Archivos de Objetos Beacon Asíncronos BOF. El primero, tgt-monitor, monitorea el sistema en busca de eventos de inicio de sesión Kerberos y activa el agente cada vez que se captura un nuevo TGT Kerberos. Similar...

impacket

Impacket Copyright Fortra, LLC y sus empresas afiliadas. Todos los derechos reservados. Impacket fue creado originalmente por SecureAuth, y actualmente mantenido por Fortra's Core Security. Impacket es una colección de clases de Python para trabajar con protocolos de red. Impacket se centra en...

Change-Lockscreen

Change-Lockscreen Change-Lockscreen is a tool to trigger network authentications as SYSTEM by changing the Windows lock screen image from the command line to perform privilege escalation attacks such as the one described in the post linked below:...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

Rubeus

Rubeus Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard component...

heimdal

Heimdal Heimdal is an implementation of: ASN.1/DER, PKIX, and Kerberos. For information how to install see here. There are man pages for most of the commands. Bug reports and bugs are appreciated. Use GitHub issues. For more information see the project homepage https://heimdal.software/heimdal/ o...

S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

zBang

zBang is a special risk assessment tool that detects potential privileged account threats in the scanned network. Organizations and red teamers can utilize zBang to identify potential attack vectors and improve the security posture of the network. The results can be analyzed with the graphic...

nimrm

nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT...

DumpGuard

DumpGuard DumpGuard es una herramienta de extracción de credenciales e investigación de protocolos para sistemas Windows modernos. Abusa del protocolo Remote Credential Guard para recuperar material de credenciales incluso cuando Credential Guard está habilitado, e incluye una ruta del paquete de...

mimikatz

mimikatz mimikatz es una herramienta que creé para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocida por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...