netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

NorkNork

NorkNork - Tool for identifying Empire persistence payloads https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ ABOUT: This script was designed to identify Powershell Empire persistence payloads on Windows systems. It currently supports checks for these persistence methods:...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 Static Malware Analysis – Follina Exploitation CVE-2022-30190 Malicious Microsoft Word Document Investigation During a practical malware analysis session on Kali Linux, I encountered a suspicious file named sample.doc. I decided to perform a structured stat...

SharpStat

SharpStat C utility that uses WMI to run "cmd.exe /c netstat -n", save the output to a file, then use SMB to read and delete the file remotely Description This script will attempt to connect to all the supplied computers and use WMI to execute cmd.exe /c netstat -n . The file the output is saved ...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

WMIHACKER

WMIHACKER（No need 445 Port） 中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common...

TChopper

TChopper New technique I have discovered recently and give it a nickname Chop chop to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool. image How it works the tool will get the...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

SysmonConfigPusher2

SysmonConfigPusher v2 A web-based tool for managing Sysmon configurations across Windows endpoints — supports both agentless WMI/SMB and agent-based deployments. Features Screenshots Dashboard| Inventory ---|--- | Config View| Config Editor ---|--- | Deployment Wizard| Deployment Pr...

CIMplant

CIMplant C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and...

gargamel

Gargamel Compile Compiled and tested with Rust 1.50+. Open terminal in the project directory and to compile a release build type root@kitploit: cargo build --release Debug build can be compiled using root@kitploit: cargo build Compiled executable is located at target/release/gargamel.exe or...

CVE-2020-1472

CVE-2020-1472 CVE 2020-1472 Script de validación Assumption: WinRM is enabled between domain controllers. Required permissions: root@kitploit: If child domains are present: Enterprise admin If single forest, single domain: Domain admin This script must be run on a primary domain controller with...

EDRUnChoker

EDRUnChoker Fileless WMI remediation forEDRChoker counters QoS abuse pacer.sys that throttles EDR agents to near-zero network bandwidth. Registers a permanent subscription in root\subscription no files on disk. A 5-second timer runs embedded VBScript that enumerates QoS policies with...

Persistence-Survivability

持久化生存能力评级 本项目将 Duqu 风格的持久化作为 TTP，并在 Bsides Augusta – RAT 上进行了展示。本项目基于 PowerShell，可配合凭据使用，也可在不使用凭据的情况下使用。更多信息请阅读 .ps1 文件。 基本用法： root@kitploit: Invoke-FindPersitence Invoke-FindPersitence -MaxHosts 100 -Top 5 Invoke-FindPersitence -Domain tester.org -OperatingSystem 7 Invoke-FindPersitence -Domain...

WMIExec

WMIexec Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute...

Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

CobaltStrike-BOF

CobaltStrike BOF Beacon BOFのコレクション。 1 DCOM Lateral Movement Beaconオブジェクトファイルを介してDCOM（ShellWindows）を使用したラテラルムーブメントの簡易PoCです。資格情報を指定するか、現在のユーザーを使用できます。現在のユーザーを使用するには、ドメイン、ユーザー名、パスワードを空のままにします。CでのCOMオブジェクトの使用に関する短い記事はこちらにあります。 2 WMI Lateral Movement - Win32Process Create...

wmi-static-spoofer

wmi-static-spoofer Motivation: The initial motivation is bypassing HWID detection methods used by intrusive software like anti-cheats, etc. or licensing restrictions implemented in software. The concept is not new but other solutions require a loaded driver at all times and a kernel hook with...

Check-LocalAdminHash

Check-LocalAdminHash Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where...