SilentHound

SilentHound Enumera silenciosamente un dominio de Active Directory mediante el análisis LDAP de usuarios, administradores, grupos, etc. Creado por Nick Swink de Layer 8 Security. Instalación Usando pipenv método recomendado root@kitploit: python3 -m pip install --user pipenv git clone...

ldap_shell

LDAP shell This project is a fork of ldapshell from Impacket. It provides an interactive shell for Active Directory enumeration and manipulation via LDAP/LDAPS protocols, making it useful for both system administrators and security professionals. Installation These tools are only compatible with...

PsMapExec

PsMapExec 🚀 What is PsMapExec? PsMapExec is a PowerShell-based post-exploitation framework, heavily inspired by the well-known CrackMapExec / NetExec tools. It brings the familiar looks and function of these tools to native PowerShell with its own arsenal of improvements. This tool is designed to...

sopa

sopa A practical client for ADWS in Golang. Sopa implements the ADWS protocol stack MS-NNS + MC-NMF + SOAP, exposing the following command-line features: Object search & retrieval query: runs LDAP-filter searches via WS-Enumeration Enumerate + Pull loop with attribute projection, scope control...

ldeep

============== Estado del proyecto .. image:: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml/badge.svg :target: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml :alt: Build status .. image:: https://badgen.net/pypi/v/ldeep :target:...

spraykatz

Spraykatz Spray love around the world Index...

SharpADWS

SharpADWS 中文文档 Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services ADWS. Overview SharpADWS is an Active Directory reconnaissance and exploitation tool for Red Teams that collects and modifies Active Directory data via the Active Directory Web...

impersonate

Impersonate Descripción Este repositorio contiene las herramientas que fueron desarrolladas mientras se escribía la siguiente entrada de blog https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/. La entrada de blog contiene toda la...

p0wnedShell

p0wnedShell PowerShell Runspace Post Exploitation Toolkit Author: Cn33liz and Skons Version: 2.6 License: BSD 3-Clause What is it: p0wnedShell is an offensive PowerShell host application written in C that does not rely on powershell.exe but runs powershell commands and functions within a powershe...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...

latma

横向移动分析工具 横向移动分析工具（LATMA）从域环境和 Azure AD 环境中收集身份验证日志，并搜索潜在的横向移动攻击及可疑活动。横向移动可能发生在 AD 环境中，也可能发生在云与本地之间。该工具通过图表展示横向移动模式的可视化结果。此工具包含两个模块：一个用于收集日志，另一个用于分析日志。您可以分别执行每个模块。事件日志收集器应在运行 Python 3.8 或更高版本的 Windows 机器上执行，且该机器需处于 Active Directory 域环境中。分析器可在 Linux 机器和 Windows 机器上执行。 收集器 事件日志收集器具有两个功能：扫描域控制器以获取成功的...

autobloody

autobloody autobloody is a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound. Description This tool automates the AD privesc between two AD objects, the source the one we own and the target the one we want if a privesc path exists in BloodHound database...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory 速查表 本仓库包含 Active Directory 环境中的通用方法论。 其中提供了一系列基于 Powershell、C、.Net 3.5 和 .Net 4.5 的最高效工具的快捷命令。 通用流程: 侦察 域枚举 本地权限提升 本地账户窃取 监控潜在传入账户 本地账户窃取 管理员侦察 横向移动 远程管理 域管理员权限 跨信任攻击 持久化与数据外泄 Active Directory 杀伤链: 速查表目录: /A - 侦察 /B - 域枚举 /C - 本地权限提升 /D - 用户搜寻 /E - 监控潜在传入账户 /F - BloodHound /G -...

adwsdomaindump

ADWSDomainDump 通过ADWS（Active Directory Web Services）进行Active Directory信息转储。 安装 推荐安装方式： root@kitploit: pipx install git+https://github.com/mverschu/adwsdomaindump 或 pipx install . 使用 root@kitploit: adwsdomaindump -u 'corp.local\jsmith' -p 'password' -n 10.0.0.1 dc01.corp.local 正在连接ADWS主机... +...

ADLab

ADLab PowerShell 模块 简介 此模块旨在自动化部署用于内部渗透测试练习的 Active Directory 实验室环境。 感谢 Joe Helle 及其 PowerShell for Pentesters 课程 提供的攻击向量生成思路。 使用说明 准备 可选但推荐：将模块移入 PSModulePath root@kitploit: Display PSModulePath $env:PSModulePath.split";" Move module to path Move-Item .\ADLab...

Find-AdminAccess

FindAdminAccess A C utility that enumerates domain computers and tests administrative access to them, including connectivity checks, admin privileges verification, and C$ share writability testing. Features Enumerate all computers in an Active Directory domain Test network connectivity Verify...

RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

GPOZaurr

GPOZaurr Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them. GPOZaurr provides 360 degrees of information about Group Policies and their settings. Just a single command Invoke-GPOZaurr provides...

freeipa

Servidor FreeIPA FreeIPA permite a los administradores de Linux gestionar de forma centralizada los aspectos de identidad, autenticación y control de acceso de los sistemas Linux y UNIX, ofreciendo herramientas de gestión por línea de comandos y web, fáciles de instalar y usar. FreeIPA está...

SharpHose

Overview SharpHose is a C password spraying tool designed to be fast, safe, and usable over Cobalt Strike's execute-assembly. It provides a flexible way to interact with Active Directory using domain-joined and non-joined contexts, while also being able to target specific domains and domain...