SSH-Private-Key-Looting-Wordlists

LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH Private Key Looting Wordlists 🔒🗝️ This repository contains a collection of wordlists to aid in locating or brute-forcing SSH private key file...

baboossh

.. image:: https://raw.githubusercontent.com/cybiere/baboossh/master/logo.png SSH spreading made easy for red teams in a hurry. BabooSSH allows you, from a simple SSH connection to a compromised host, to quickly gather info on other SSH endpoints to pivot and compromise them. Licence +++++++...

PoshC2

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

SynthAPT

SynthAPT Overview SynthAPT is a playbook-based adversary simulation framework for replicating complex attack paths. It is designed for validating advanced detections and AI-based investigation agents. The core idea is that malware behavior can be expressed in JSON and compiled into functional...

harpyTools

Active Directory Post-Exploitation and Relay Automation Utilities This repository contains a collection of Python orchestrator scripts designed for security assessments and penetration testing within Active Directory environments. These tools are specifically engineered for post-exploitation...

BloodHound-Tools

What is this? A collection of tools that integrate to BloodHound. Bloodhound is the defacto standard that both blue and red security teams use to find lateral movement and privilege escalation paths that can potentially be exploited inside an enterprise environment. A typical environment can yiel...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level. It can be used to delegate and take over the inbox of other users including domain administrators after obtaining the credentials of a regular mailbox account. This EXP script is an enhanced...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

MoveKit

MoveKit - Cobalt Strike lateral movement kit Movekit is an extension of built in Cobalt Strike lateral movement by leveraging the executeassembly function with the SharpMove and SharpRDP .NET assemblies. The aggressor script handles payload creation by reading the template files for a specific...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

ldeep

============== Project Status .. image:: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml/badge.svg :target: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml :alt: Build status .. image:: https://badgen.net/pypi/v/ldeep :target:...

CVE-2018-8581

CVE-2018-8581 This is a lateral movement and privilege escalation vulnerability at the mailbox level Once you have the credentials of an ordinary mailbox account, it allows you to delegate and take over the inboxes of other users including domain administrators This EXP script is an enhanced...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

Awesome-RedTeam-Cheatsheet

Red Team Techniques Initial Access Techniques soon Code Execution Techniques soon Lateral Mouvement Techniques soon Evasion Techniques soon Persistence Techniques soon Privilege Escalation Techniques soon Credential Dumping Techniques soon Pivoting Techniques soon Windows Protocols and...

WMIHACKER

WMIHACKER（No need 445 Port） 中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

bat

Behavioral Adversary Tracer BAT BAT is a realistic, evolving adversary threat model for Linux and Windows. It is not a C2 framework and it is not a rootkit. It is a complete threat simulation platform that integrates C2 communication, kernel-level stealth rootkit modules, userspace evasion,...

DCOMrade

DCOMrade DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script...