topotam

certsync

Dump NTDS with golden certificates and UnPAC the hash

Revenant

Revenant - A 3rd party agent for Havoc that demonstrates evasion techniques in the context of a C2 framework

Revenant

Revenant - A 3rd party agent for Havoc that aim to demonstrate evasion techniques in the context of a C2 framework

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

CMLoot

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares

Havoc

The Havoc Framework.

CheeseOunce

Coerce Windows machines auth via MS-EVEN

CheeseOunce

Coerce Windows machines auth via MS-EVEN

MSSQL-Analysis-Coerce

A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine.

Elevator

UAC Bypass by abusing RPC and debug objects.

EDRSandblast

DFSCoerce

SliverKeylogger

DFSCoerce

ica2tcp

A SOCKS proxy for Citrix.

C2-Tool-Collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

Certipy

Tool for Active Directory Certificate Services enumeration and abuse

PetitPotam

Python implementation for PetitPotam

CobaltBus

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus

lnkbomb

Malicious shortcut generator for collecting NTLM hashes from insecure file shares.

VSSTrigger

palinka_c2

Just another useless C2 occupying space in some HDD somewhere.

COFFLoader2

Load and execute COFF files and Cobalt Strike BOFs in-memory

Active-Directory-Exploitation-Cheat-Sheet

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

EDRSandblast

InlineWhispers2

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

Backstab

A tool to kill antimalware protected processes

lsarelayx

NTLM relaying for Windows made easy

marcel

Le docker français :whale: :fr:

ZipExec

A unique technique to execute binaries from a password protected zip