g0ldengunsec Goto Github PK

backdoorlnkmacrostagercellembed

Powershell Empire 2.x stager that allows for creation of a macro which uses VBA to backdoor .lnk files on the system. This is done to obtain a shell via follow-up user interaction natively through powershell, in order to evade tools that monitor process execution. Data is embedded in .xls cells and called in the macro to evade detection. Backdoors are self-cleaning on execution.

backdoorlnkmacrostagerobfuscated

Obfuscated Powershell Empire 2.x stager that allows for creation of a macro which uses VBA to backdoor .lnk files on the system. This is done to obtain a shell via follow-up user interaction natively through powershell, in order to evade tools that monitor process execution. Backdoors are self-cleaning on execution.

bloodhound

Six Degrees of Domain Admin

covenant

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.

cve-2020-1472

Test tool for CVE-2020-1472

daybird

Extension functionality for the NightHawk operator client

empire

Empire is a PowerShell and Python post-exploitation agent.

getwebdavstatus

Determine if the WebClient Service (WebDAV) is running on a remote system

impacket

Impacket is a collection of Python classes for working with network protocols.

powerpriv

A Powershell implementation of PrivExchange designed to run under the current user's context

preliminarybackdoorlnkmacrostager

Original testing version of the backdoorLnkMacroStager - please reference backdoorLnkMacroStagerObfuscated or backdoorLnkMacroStagerCellEmbed for current versions

rubeus

Trying to tame the three-headed dog.

service-executable-permissions-checker

sharplinkcreate

sharpsecdump

.Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py

sharptransactedload

Load .net assemblies from memory while having them appear to be loaded from an on-disk location.

standin

StandIn is a small .NET35/45 AD post-exploitation toolkit

wmiservsessenum

.net tool that uses WMI queries to enumerate active sessions and accounts configured to run services on remote systems