This list is for anyone wishing to learn offensive Windows security. The list will for the most part consist of tools available on Github.
The tools are categorized according to Adversarial Tactics and Techniques based on Mitre ATT&CK. Some tools fit several technqiues and some doesn't quite fit anywhere. I appreciate any help with finding the right tactics and techniques.
Table of Contents
- Initial Access
- Privilege Escalation
- Defense Evasion
- Credential Access
- Lateral Movement
- Command and Control
- ruler - Gain shell through Exchange rules
- SharpWMI - C# implementation of various WMI functionality.
- WheresMyImplant - Contains the tooling nessessary to gaining and maintain access to target system. It can also be installed as WMI provider for covert long term persistence.
- PowerUp - PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations.
- SharpUp - C# port of various PowerUp functionality.
- alpc-diaghub - Utilizing the ALPC Flaw in combiniation with Diagnostics Hub as found in Server 2016 and Windows 10.
- juicy-potato - Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.
- Tokenvator - A tool to elevate privilege with Windows Tokens
- Article - Oh No! AMSI blocked the AMSI Bypass! What now? - Works on W10 1803 - 09.11.18
- Article - AmsiScanBuffer Bypass - Part 1 - Works on W10 1803 - 01.11.18
- Article - Undetectable C# & C++ Reverse Shells
- Invoke-Phant0m - This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
- Procedure - Remotely Enumerate Anti-Virus Configurations
- Procedure - Remotely Modify Anti-Virus Configurations
- mimikatz_obfuscator.sh - Obfuscation tool for Mimikatz.
- SharpCradle - Download and execute .NET binaries into memory.
- Rubeus - C# toolset for raw Kerberos interaction and abuses.
- KeeThief - Methods for attacking KeePass 2.X databases, including ing of encryption key material from memory.
- SharpCloud - C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.
- credgrap_ie_edge - Extract stored credentials from Internet Explorer and Edge.
- windows_sshagent_extract - PoC code to extract private keys from Windows 10's built in ssh-agent service.
- MailSniper - Searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.)
- DomainPasswordSpray - PowerShell tool to perform a password spray attack against users of a domain.
- SprayingToolkit - Scripts to make password spraying attacks against Lync/S4B & OWA a lot quicker, less painful and more efficient
- mimikatz - Dumping credentials in Windopws
- Internal-Monologue - Retrieving NTLM Hashes without Touching LSASS.
- lazykatz - Lazykatz is an automation developed to extract credentials from remote targets protected with AV and/or application whitelisting software.
- poshkatz - PowerShell module for Mimikatz
- Powerdump.ps1 - Dumping SAM from Powershell
- Responder - Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
- Inveigh - Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool.
- InveighZero - C# LLMNR/NBNS spoofer
- PowerView Dev Branch - Enumerating AD with Powershell. The dev branch is specifically recommended for its ability to specify credentials using the
- SharpView - C# implementation of harmj0y's PowerView
- BloodHound - Graphically map Active Directory environment.
- SharpHound - The BloodHound C# Ingestor
- SmbScanner - A Smb Scanner written in powershell Extracted from PingCastle and adapted to fit in a script. Checks for SMBv1 and SMBv2 (SMBv3 is a dialect of SMBv2).
Windows-Exploit-Suggester - This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.
Watson - C# implementation for quickly finding missing software patches for local privilege escalation vulnerabilities.
- Procedure - Mimikatz Pass-The-Hash -
mimikatzcan perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead of its real password.
- Tool - CrackMapExec - A swiss army knife for pentesting networks
- Article - A Red Teamer's guide to pivoting
- Tool - mimikittenz - A post-exploitation powershell tool for extracting juicy info from memory.
- Tool - SlackExtract - A PowerShell script to download all files, messages and user profiles that a user has access to in slack.
- SharpBox - C# tool for compressing, encrypting, and exfiltrating data to using the DropBox API.
- Empire - Empire is a PowerShell and Python post-exploitation agent.
- SILENTTRINITY - A post-exploitation agent powered by Python, IronPython, C#/.NET
- Cobalt Strike - Software for Adversary Simulations and Red Team Operations.
- awesome-windows-domain-hardening - A curated list of awesome Security Hardening techniques for Windows.
- UncoverDCShadow - Detect the use of the DCShadow attack.
- Seatbelt - Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
- Pingcastle - Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework.
- WindowsDefenderATP-Hunting-Queries - Sample queries for Advanced hunting in Windows Defender ATP
Post Exploitation Frameworks & Tools
- PowerSploit - A PowerShell Post-Exploitation Framework
- SharpSploit - .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers.
- SharpSploitConsole - Console Application designed to interact with SharpSploit.
- SharpAttack - A simple wrapper for C# tools. It contains commands for domain enumeration, code execution, and other fun things.
- LOLBAS - every binary, script, and library that can be used for Living Off The Land techniques.
- DeathStar - Automate getting Domain Admin using Empire
- awesome-windows-exploitation - A curated list of awesome Windows Exploitation resources, and shiny things.
- PowerShellArsenal - A PowerShell Module Dedicated to Reverse Engineering
- SharpCompile - SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.
- SharpGen - SharpGen is a .NET Core console application that utilizes the Rosyln C# compiler to quickly cross-compile .NET Framework console applications or libraries.
↑ Red Team
- Red Tips of Vysec
- Planning a Red Team exercise
- Advanced Penetration Testing: Hacking the World's Most Secure Networks
- Windows Internals, Part 1: System architecture, processes, threads, memory management, and more (7th Edition)
- How to Hack Like a LEGEND: A hacker’s tale breaking into a secretive offshore company (Hacking the Planet Book 7)
- Nikhil Mittal - @nikhil_mitt
- Marcello - @byt3bl33d3r
- Sean Metcalf - @PyroTek3
- Vincent Yiu - @vysecurity
- Cn33liz - @Cneelis
- Rasta Mouse - @_RastaMouse
- SpecterOps - @SpecterOps
If you want to contribute a technique please use the following template. You are allowed to link to multiple procedures and articles for each tool
### [T1234 - Name of Technique](https://attack.mitre.org/techniques/T1234/) * [github-repo](https://github.com/username/github-repo) - Description from repo. Copypaste is allowed. * [Procedure](https://link.to.procedure.com) * [Article](https://link.to.article.com)