offsecguy

GhostTask

A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.

PowerAssembly

Map remote .NET assemblies to memory for further invocation.

ntlm_theft

A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

Farmer

CVE-2023-23397-POC-Powershell

Sandboxie

Sandboxie Plus & Classic

Spartacus

Spartacus DLL/COM Hijacking Toolkit

macro_pack

macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to final document generation. It also provides a lot of helpful features useful for redteam or security research.

PowerShdll

Run PowerShell with rundll32. Bypass software restrictions.

RasmanPotato

Abuse Impersonate Privilege from Service to SYSTEM like other potatoes do

NetLoader

Loads any C# binary in mem, patching AMSI + ETW.

AutoRecon

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

pwndoc

Pentest Report Generator

ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

BloodHound-Tools

Collection of tools that reflect the network dimension into Bloodhound's data

adidnsdump

Active Directory Integrated DNS dumping by any authenticated user

Powermad

PowerShell MachineAccountQuota and DNS exploit tools

StandIn

StandIn is a small .NET35/45 AD post-exploitation toolkit

SpoolSample

PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.

SharpPrinter

Discover Printers

SharpOxidResolver

IOXIDResolver from AirBus Security/PingCastle

SharpHound

C# Data Collector for BloodHound

SharpExec

SCShell

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

pingcastle

PingCastle - Get Active Directory Security at 80% in 20% of the time

mimikatz

Lockless

Lockless allows for the copying of locked files.

Inveigh

.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

Group3r

Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.