aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

tofu

tofu A modular tool for hacking offline Windows filesystems and bypassing login screens. Can do hashdumps, OSK-Backdoors, user enumeration and more. How it works : When a Windows machine is shut down, unless it has Bitlocker or another encryption service enabled, it's storage device contains...

pypykatz

🚩 Patrocinadores Si te gusta este proyecto, considera comprar licencias de OctoPwn, nuestro conjunto completo de herramientas de pentesting que se ejecuta en tu navegador. Para notificaciones sobre nuevas versiones/lanzamientos y otra información, únete a nuestro Discord pypykatz Implementación d...

aggrokatz

aggrokatz 这是什么 aggrokatz 是一个用于 CobaltStrike 的 Aggressor 插件扩展，它使 pypykatz 能够远程与 beacon 交互。 当前版本的 aggrokatz 允许 pypykatz 解析 LSASS 转储文件和注册表配置单元文件，以提取凭据和其他机密，而无需下载文件，也无需向 beacon 上传任何可疑代码（Cobalt Strike 本身已在运行）。 未来，该项目旨在为隐蔽操作提供更多功能，例如搜索和解密所有 DPAPI 机密/kerberoasting 等。 我们为此工具发布了一篇简短的 博客文章，其中包含一些截图。 重要说明 -...

NativeDump - Dump Lsass Using Only Native APIs By Hand-Crafting Minidump Files (Without MinidumpWriteDump!)

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the "SeDebugPrivilege"...

MultiDump - Post-Exploitation Tool For Dumping And Extracting LSASS Memory Discreetly

MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xre0us.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offers two...

Nanodump - A Crappy LSASS Dumper With No ASCII Art

A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls with SysWhispers2 for most operations. Syscalls are called from an ntdll address to bypass some syscall detections. It sets the syscall callback hook to NULL. Windows APIs are called using dynamic invoke...