Privilege Escalation & Post-Exploitation

---

Table of Contents

• Privilege Escalation
  • Hardware-based Privilege Escalation
  • Linux Privilege Escalation
  • CSharp Things
  • Powershell Things
• Post-Exploitation
  • General Post Exploitation Tactics
  • Linux Post Exploitation
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
  • OS X Post Exploitation
    • Educational
    • AppleScript
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
  • Windows Post Exploitation
    • 101
    • Living_off_The_Land
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
    • Windows Technologies
    • Application Shims
    • Code Signing
    • Windows Technologies
      • ClickOnce
      • DPAPI
      • ETW
      • Logging
      • PowerShell Desired State
      • Windows Communication Facility
      • Windows Notification Facility
      • Windows Scripting Host
• Active Directory
  • Attacking AD 101
  • Active Directory Technologies
    • ADFS
    • AdminSD
    • Advanced Threat Analytics
    • Advanced Threat Protection
    • DACLs
    • DNS
    • Domain Trusts
    • Forests
    • Group Policy
    • Kerberos
    • LDAP
    • Local Admin Password Solution
    • Lync
    • MS-SQL
    • NTLM
    • Read-Only Domain Controllers
    • Red Forest
    • Service Principal Names
    • System Center Configuration Manager
    • Domain Trusts
    • WSUS
  • Attacking AD
    • Hunting Users
    • DCShadow
    • DCSync
    • Kerberos Delegation
      • Constrained
      • Un-Constrained
    • Kebreroasting
    • Pass-the-*
    • Shadow Admin
    • Skeleton Key
    • AD Vulnerabilities(CVEs)
    • Defense Evasion
    • Collection
    • Credential Access
    • Persistence
    • Privilege Escalation
    • Reconnaissance
• Pivoting
• Avoiding/Bypassing Anti-Virus/Whitelisting/Sandboxes/etc
• Payloads

---

Privilege Escalation

---

Hardware-based Privilege Escalation

• Writeups
  • Windows DMA Attacks : Gaining SYSTEM shells using a generic patch
  • Where there's a JTAG, there's a way: Obtaining full system access via USB
  • Snagging creds from locked machines - mubix
  • Bash Bunny QuickCreds – Grab Creds from Locked Machines
  • PoisonTap
    • Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
  • Rowhammer
    • Exploiting the DRAM rowhammer bug to gain kernel privileges
    • Row hammer - Wikipedia
    • Another Flip in the Wall of Rowhammer Defenses
    • rowhammer.js
      • Rowhammer.js - A Remote Software-Induced Fault Attack in JavaScript
    • Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript
    • Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors
      • Abstract. Memory isolation is a key property of a reliable and secure computing system — an access to one memory ad- dress should not have unintended side e ects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more diffcult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row’s wordline, which stresses inter-cell coupling e ects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing plat- form. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining var- ious potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors.
• Tools
  • Inception
    • Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces.
  • PCILeech
    • PCILeech uses PCIe hardware devices to read and write from the target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system.
  • physmem
    • physmem is a physical memory inspection tool and local privilege escalation targeting macOS up through 10.12.1. It exploits either CVE-2016-1825 or CVE-2016-7617 depending on the deployment target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the same. They were patched in OS X El Capitan 10.11.5 and macOS Sierra 10.12.2, respectively.
  • rowhammer-test
    • Program for testing for the DRAM "rowhammer" problem
  • Tools for "Another Flip in the Wall"

---

C# Stuff

• 101
  • GhostPack
  • Interesting DFIR traces of .NET CLR Usage Logs -
• Educational
  • A Lesson in .NET Framework Versions - Rastamouse
  • The 68 things the CLR does before executing a single line of your code - mattwarren.org
  • An Introduction to Microsoft .NET Remoting Framework - docs.ms
  • OffensiveCSharp-matterpreter
    • This is a collection of C# tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release".
    • SharpBox is a C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API.
  • Hijacking .NET to Defend PowerShell - Amanda Rosseau
    • Abstract—With the rise of attacks using PowerShell in the recent months, there has not been a comprehensive solution for monitoring or prevention. Microsoft recently released the AMSI solution for PowerShell v5, however this can also be bypassed. This paper focuses on repurposing various stealthy runtime .NET hijacking techniques implemented for PowerShell attacks for defensive monitoring of PowerShell. It begins with a brief introduction to .NET and PowerShell, followed by a deeper explanation of various attacker techniques, which is explained from the perspective of the defender, including assembly modification, class and method injection, compiler profiling, and C based function hooking. Of the four attacker techniques that are repurposed for defensive real-time monitoring of PowerShell execution, intermediate language binary modification, JIT hooking, and machine code manipulation provide the best results for stealthy run-time interfaces for PowerShell scripting analysis
• Credentials
  • Dumping Process Memory with Custom C# Code - 3xplo1tcod3r
  • SharpDPAPI
    • SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
  • SharpDump
    • SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
  • SharpLocker
    • SharpLocker helps get current user credentials by popping a fake Windows lock screen, all output is sent to Console which works perfect for Cobalt Strike. It is written in C# to allow for direct execution via memory injection using techniques such as execute-assembly found in Cobalt Strike or others, this method prevents the executable from ever touching disk. It is NOT intended to be compilled and run locally on a device.
  • SharpClipboard
    • C# Clipboard Monitor
    • Blogpost
  • ADFSpoof
    • A python tool to forge AD FS security tokens. - Meant to be used with ADFSDump
  • ADFSDump
    • ADFSDump is a tool that will read information from Active Directory and from the AD FS Configuration Database that is needed to generate forged security tokens. This information can then be fed into ADFSpoof to generate those tokens. - Meant to be used with ADFSpoof
  • SharpDomainSpray
    • SharpDomainSpray is a very simple password spraying tool written in .NET. It takes a password then finds users in the domain and attempts to authenticate to the domain with that given password.
  • SafetyKatz
    • SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader.
  • Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
    • Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
  • InveighZero
    • Windows C# LLMNR/mDNS/NBNS/DNS spoofer/man-in-the-middle tool
  • RdpThief
    • RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file.
    • Blogpost
  • ATPMiniDump
    • Dumping LSASS memory with MiniDumpWriteDump on PssCaptureSnapShot to evade WinDefender ATP credential-theft.
  • SprayAD
    • This tool can help Red and Blue teams to audit Active Directory useraccounts for weak, well known or easy guessable passwords and can help Blue teams to assess whether these events are properly logged and acted upon. When this tool is executed, it generates event IDs 4771 (Kerberos pre-authentication failed) instead of 4625 (logon failure). This event is not audited by default on domain controllers and therefore this tool might help evading detection while password spraying.
  • Rubeus
    • Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 4.0 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v3.0 license). Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not exist.https://www.slideshare.net/aj0612/a-study-on-net-framework-for-red-team-part-i
• Collection
  • Sharp-Profit
    • "Sharp-Profit is a C# version of my Profit script. This version can be utilized with Cobalt Strike's execute-assembly function. Seeing as how most people are moving away from PowerShell I figured this would be a good learning opportunity. This is my first program made in C#, so I’m sure the flow isn’t the greatest. Let me know any improvements that could be made or additional functionality!"
  • FirePwd.Net
    • FirePwd.Net is an open source tool wrote in C# to decrypt Mozilla stored password.
  • SharpWeb
    • SharpWeb is a .NET 2.0 CLR compliant project that can retrieve saved logins from Google Chrome, Firefox, Internet Explorer and Microsoft Edge. In the future, this project will be expanded upon to retrieve Cookies and History items from these browsers.
  • SharpCloud
    • SharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.
  • WireTap
    • .NET 4.0 Project to interact with video, audio and keyboard hardware.
• Discovery
  • Seatbelt
    • Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
  • SharpView
  • HastySeries
    • A C# toolset to support offensive operators to triage, asses and make intelligent able decisions. Provided operators access to toolsets that can be integrated into other projects and workflow throughout a Red Team, Pentest or host investigation. We built this toolset over a period of a few days, hence the tool prefix of "Hasty".
  • reconerator
    • This is a custom .NET assembly which will perform a number of situational awareness activities.
  • SharpSniper
    • Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires that you have privileges to read logs on Domain Controllers. First it queries and makes a list of Domain contollers, then search for Log-on events on any of the DCs for the user you are looking for and then reads the most recent DHCP allocated logon IP address.
  • SharpWitness
    • SharpWitness is my attempt at cobbling together a C# version of EyeWitness by Christopher Truncer. It still barely functions right now, but will hopefully become more useful once I put some dev time into it.
  • SharpPrinter
    • Printer is a modified and console version of ListNetworks
  • SharpSearch
    • Search files for extensions as well as text within.
  • SharpFruit
    • A C# penetration testing tool to discover low-haning web fruit via web requests.
  • Recon-AD
    • As a proof of concept, we[OutflankNL] developed an C/C++ Active Directory reconnaissance tool based on ADSI and reflective DLLs which can be used within Cobalt Strike. The tool is called “Recon-AD” and at this moment consist of seven Reflective DLLs and a corresponding aggressor script. This tool should help you moving away from PowerShell and .NET when enumerating Active Directory and help you stay under the radar from the latest monitoring and defense technologies being applied within modern environments.
• Execution
  • RunDLL32 your .NET (AKA DLL exports from .NET) - Adam Chester
    • In this post I wanted to look at a technique which is by no means new to .NET developers, but may prove useful to redteamers crafting their tools... exporting .NET static methods within a DLL... AKA using RunDLL32 to launch your .NET assembly.
  • Staying # & Bringing Covert Injection Tradecraft to .NET - The Wover, Ruben Boonen(BlueHat IL 2020)
    • As .NET has taken over as the preferred platform for development on Windows, many attackers have chosen to take advantage of its features for post-exploitation tradecraft. Legitimate APIs can be leveraged for nearly every imaginable task, managed code can be loaded and executed from memory with extraordinary ease, and scalable monitoring for suspicious usage of .NET APIs is a problem yet to be solved. However, offensive .NET tools are still hindered by a fundamental weakness: the inability to leverage unmanaged code (such as the Win32/NT APIs) safe from observation by EDR. Managed code must eventually invoke unmanaged code in order to interface with the operating system. It is here that the attacker may be caught in the hooks of any system keen on watching for fundamentally malicious behavior. To expose the depth of tradecraft still unexplored in .NET and highlight the fragility of many existing detections, we will detail the tools we have built for evading these hooks. All of our efforts have been integrated into SharpSploit, a .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. Over the past few months we have added numerous new tools and techniques for loading and executing unmanaged code safely from .NET. Unmanaged APIs may be safely accessed and modules loaded either from memory or from disk in the new DInvoke API, a dynamic replacement for .NET's PInvoke API. It also includes manual mapping, a generic syscall wrapper, a new technique we call Module Overloading, and more. Additionally, we have added a modular process injection API that allows tool developers to build their own injection technique. Simply select an allocation and injection primitive, pass in any options, and execute the result with your preferred payload. This exposes all possible design decisions to the user, and allows for easy adaptation when existing tools fail. In our talk we will focus on explaining the fundamental tradecraft behind these new developments, the challenges and requirements associated with them, and how they can be adapted to suit your needs. Additionally, we will discuss how SharpSploit can be combined with other open-source projects to be integrated into a red team's tooling. As much as possible, we will also discuss how to counter and detect the techniques that we have developed. Finally, we will explain the community-focused development of these projects and how you too can contribute to advance open-source .NET tradecraft
  • CSExec
    • This is an example for how to implement psexec (from SysInternals Suite) functionality, but in open source C#. This does not implement all of the psexec functionality, but it does implement the equivalent functionality to running: psexec -s \target-host cmd.exe
  • SharpGPOAbuse
    • SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
  • SharpCradle
    • SharpCradle is a tool designed to help penetration testers or red teams download and execute .NET binaries into memory.
  • ManagedWindows
    • Managed wrappers around the Windows API and some Native API
  • DotNet Core: A Vector For AWL Bypass & Defense Evasion - bohops
  • TikiService
    • TikiService is a new .NET Service Binary that allows you to run a TikiTorch payload via the Service Control Manager (à la PsExec). This blog post provides a brief overview and usage examples.
  • Create a Trimmed Self-Contained Single Executable in .NET Core 3.0 - talkingdotnet.com
  • SharpExcel4-DCOM
    • Port of Invoke-Excel4DCOM
  • Running a .NET Assembly in Memory with Meterpreter - Thomas Hendrickson
  • Reflection in the .NET Framework - docs.ms
  • PowerAvails
    • PowerAvails Powershell .NET Operating system
  • Offensive P/Invoke: Leveraging the Win32 API from Managed Code - Matt Hand
  • Using Parameters With InstallUtil - ip3lee
  • Shellcode: Loading .NET Assemblies From Memory - modexp
  • OffensiveDLR
    • Toolbox containing research notes & PoC code for weaponizing .NET's DLR
  • MemorySharp
    • MemorySharp is a C# based memory editing library targeting Windows applications, offering various functions to extract and inject data and codes into remote processes to allow interoperability.
  • Running a .NET Assembly in Memory with Meterpreter - Thomas Hendrickson
  • RunShellcode
    • Simple GUI program when you just want to run some shellcode.
  • ManagedInjection
    • A proof of concept for dynamically loading .net assemblies at runtime with only a minimal convention pre-knowledge
  • SharpAttack
    • SharpAttack is a console for certain things I use often during security assessments. It leverages .NET and the Windows API to perform its work. It contains commands for domain enumeration, code execution, and other fun things.
  • DotNetToJScript
    • This file is part of DotNetToJScript - A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class.
  • SharpNado - Teaching an old dog evil tricks using .NET Remoting or WCF to host smarter and dynamic payloads - redxorblue
    • SharpNado is proof of concept tool that demonstrates how one could use .Net Remoting or Windows Communication Foundation (WCF) to host smarter and dynamic .NET payloads. SharpNado is not meant to be a full functioning, robust, payload delivery system nor is it anything groundbreaking. It's merely something to get the creative juices flowing on how one could use these technologies or others to create dynamic and hopefully smarter payloads. I have provided a few simple examples of how this could be used to either dynamically execute base64 assemblies in memory or dynamically compile source code and execute it in memory. This, however, could be expanded upon to include different kinds of stagers, payloads, protocols, etc.
• Lateral Movement
  • SharpExec - Lateral Movement With Your Favorite .NET Bling - RedXORBlue
    • SharpExec - Github
  • Lateral movement via MSSQL: a tale of CLR and socket reuse - Juan Manuel Fernandez, Pablo Martínez
    • Recently, our Red Team had to deal with a restricted scenario, where all traffic from the DMZ to the main network was blocked, except for connections to specific services like databases and some web applications. In this article, we will explain how we overcame the situation, covering the technical details. We also introduce mssqlproxy, a tool for turning a Microsoft SQL Server into a socks proxy.
  • SharpCOM
    • SharpCOM is a c# port of Invoke-DCOM
  • SharpRPD
    • Remote Desktop Protocol .NET Console Application for Authenticated Command Execution
    • Revisiting Remote Desktop Lateral Movement - Steven F
  • SharpMove
    • .NET Project for performing Authenticated Remote Execution
  • SCShell
    • Fileless lateral movement tool that relies on ChangeServiceConfigA to run command
  • SharpWMI
    • SharpWMI is a C# implementation of various WMI functionality. This includes local/remote WMI queries, remote WMI process creation through win32_process, and remote execution of arbitrary VBS through WMI event subscriptions. Alternate credentials are also supported for remote methods.
  • SharpDoor
    • SharpDoor is alternative RDPWrap written in C# to allowed multiple RDP (Remote Desktop) sessions by patching termsrv.dll file, for opsec considerations SharpDoor still using cmd.exe to run sc services to impersonating as trustedinstaller in the future will be avoiding cmd.exe usage, currently only support for Windows 10.
• Persistence
  • SharpStay
    • .NET project for installing Persistence
  • Task Scheduler
    • Provides a .NET wrapper for the Windows Task Scheduler. It aggregates the multiple versions, provides an editor and allows for localization.
• PrivEsc
  • SharpExchangePriv
    • A C# implementation of PrivExchange by @_dirkjan. Kudos to @g0ldenGunSec, as I relied on his code.
  • SharpUp
    • SharpUp is a C# port of various PowerUp functionality. Currently, only the most common checks have been ported; no weaponization functions have yet been implemented.
  • Watson
    • Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
• Other
  • bytecode-api
    • C# library with common classes, extensions and additional features in addition to the .NET Framework. BytecodeApi implements lots of extensions and classes for general purpose use. In addition, specific classes implement more complex logic for both general app development as well as for WPF apps. Especially, boilerplate code that is known to be part of any Core DLL in a C# project is likely to be already here. In fact, I use this library in many of my own projects. For this reason, each class and method has been reviewed numerous times. BytecodeApi is highly consistent, particularly in terms of structure, naming conventions, patterns, etc. The entire code style resembles the patterns used in the .NET Framework itself. You will find it intuitive to understand.
  • OutlookToolbox
    • OutlookToolbox is a C# DLL that uses COM to do stuff with Outlook. Also included is a Cobalt Strike aggressor script that uses Outlooktoolbox.dll to give it a graphical and control interface.
    • Blogpost
  • Using C# for post-PowerShell attacks - John Bergbom(2018)
  • SharpBox

---

Powershell Things

• 101
• Educational
  • Get-Help: An Intro to PowerShell and How to Use it for Evil - Jared Haight
  • Brosec
    • Brosec is a terminal based reference utility designed to help us infosec bros and broettes with usefuPowershelll (yet sometimes complex) payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to generate on the fly reverse shells (python, perl, powershell, etc) that get copied to the clipboard.
  • Introducing PowerShell into your Arsenal with PS>Attack - Jared Haight
    • Introducing PS Attack, a portable PowerShell attack toolkit - Jared Haight
  • PowerShell Secrets and Tactics Ben0xA
  • Egress Testing using PowerShell
  • Defensive Coding Strategies for a High-Security Environment - Matt Graeber - PowerShell Conference EU 2017
    • How sure are you that your PowerShell code is prepared to handle anything that a user might throw at it? What if the user was an attacker attempting to circumvent security controls by exploiting a vulnerability in your script? This may sound unrealistic but this is a legitimate concern of the PowerShell team when including PowerShell code in the operating system. In a high-security environment where strict AppLocker or Device Guard rules are deployed, PowerShell exposes a large attack surface that can be used to circumvent security controls. While constrained language mode goes a long way in preventing malicious PowerShell code from executing, attackers will seek out vulnerabilities in trusted signed code in order to circumvent security controls. This talk will cover numerous different ways in which attackers can influence the execution of your code in unanticipated ways. A thorough discussion of mitigations against such attacks will then follow.
• Articles/Blogposts/Presentations/Talks/Writeups
  • Client Side attacks using Powershell
  • Accessing the Windows API in PowerShell via internal .NET methods and reflection
    • It is possible to invoke Windows API function calls via internal .NET native method wrappers in PowerShell without requiring P/Invoke or C# compilation. How is this useful for an attacker? You can call any Windows API function (exported or non-exported) entirely in memory. For those familiar with Metasploit internals, think of this as an analogue to railgun.
  • PSReflect
    • Easily define in-memory enums, structs, and Win32 functions in PowerShell
• Command and Control
  • Empire
    • Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent. It is the merge of the previous PowerShell Empire and Python EmPyre projects. The framework offers cryptologically-secure communications and a flexible architecture. On the PowerShell side, Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework. PowerShell Empire premiered at BSidesLV in 2015 and Python EmPyre premeiered at HackMiami 2016.
  • Koadic
    • Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10.
  • Babadook
    • Connection-less Powershell Persistent and Resilient Backdoor
• Bypass X
  • General
    • nps_payload
      • This script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources.
  • AMSI
    • See Avoiding AV section
  • Constrained-Language Mode
    • Articles/Blogposts/Writeups
      • PowerShell Constrained Language Mode - devblogs.ms
      • Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode
      • AppLocker CLM Bypass via COM - MDSec
      • Powershell CLM Bypass Using Runspaces - Shaksham Jaiswal
        • CLMBypassBlogpost
      • A Comparison of Shell and Scripting Language Security - PowerShell Team
    • Tools
      • DotNetToJScript Constrained/Restricted LanguageMode Breakout
        • This repository is based on a post by @xpn, more details available here. Xpn's post outlines a bug of sorts where ConstrainedLanguage, when enforced through AppLocker does not prevent COM invocation. Because of this it is possible to define a custom COM object in the registry and force PowerShell to load a Dll. On load it is possible to change the LanguageMode to FullLanguage and break out of the restricted shell. This repo is a variation on this technique where a DotNetToJScript scriptlet is used to directly stage a .Net assembly into the PowerShell process.
      • PoSH_Bypass
        • PoSHBypass is a payload and console proof of concept that allows an attatcker or for that matter a legitimate user to bypass PowerShell's 'Constrianed Language Mode, AMSI and ScriptBlock and Module logging'. The bulk of this concept is the combination of 3 separate pieces of research, I've stuck these 3 elements together as my first attempt at non 'Hello World!' C# project.
      • PSByPassCLM
        • Bypass for PowerShell Constrained Language Mode
      • powershellveryless
        • Constrained Language Mode + AMSI bypass all in one(Currently Blocked without modification)
  • Execution Policy
    • 15 Ways to Bypass the PowerShell Execution Policy - NetSPI
    • Bat Armor
      • Bypass PowerShell execution policy by encoding ps script into bat file.
  • Logging
    • About Eventlogs(PowerShell) - docs.ms
    • Script Tracing and Logging - docs.ms
    • PowerShell ScriptBlock Logging Bypass
    • A Critique of Logging Capabilities in PowerShell v6
      • Introduces 'PowerShell Upgrade Attack'
    • Bypass for PowerShell ScriptBlock Warning Logging of Suspicious Commands - cobbr.io
• Frameworks
  • Empire -> See rt.md
  • Powersploit
  • Nishang
    • Nishang
      • Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.
    • Hacking In Windows Using Nishang With Windows PowerShell, Like A Boss! - serenity-networks.com
• Dumping/Grabbing Creds
  • Out-Minidump.ps1
    • Generates a full-memory minidump of a process.
  • PShell Script: Extract All GPO Set Passwords From Domain
    • This script parses the domain’s Policies folder looking for Group.xml files. These files contain either a username change, password setting, or both. This gives you the raw data for local accounts and/or passwords enforced using Group Policy Preferences. Microsoft chose to use a static AES key for encrypting this password. How awesome is that!
  • mimikittenz
    • A post-exploitation powershell tool for extracting juicy info from memory.
  • Inveigh
    • Inveigh is a PowerShell LLMNR/mDNS/NBNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system.
  • PowerMemory
    • Exploit the credentials present in files and memory. PowerMemory levers Microsoft signed binaries to hack Microsoft operating systems.
  • Dump-Clear-Text-Password-after-KB2871997-installed
    • Auto start Wdigest Auth,Lock Screen,Detect User Logon and get clear password.
  • SessionGopher
    • SessionGopher is a PowerShell tool that finds and decrypts saved session information for remote access tools. It has WMI functionality built in so it can be run remotely. Its best use case is to identify systems that may connect to Unix systems, jump boxes, or point-of-sale terminals. SessionGopher works by querying the HKEY_USERS hive for all users who have logged onto a domain-joined box at some point. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. It automatically extracts and decrypts WinSCP, FileZilla, and SuperPuTTY saved passwords. When run in Thorough mode, it also searches all drives for PuTTY private key files (.ppk) and extracts all relevant private key information, including the key itself, as well as for Remote Desktop (.rdp) and RSA (.sdtid) files.
  • Invoke-WCMDump
    • PowerShell script to dump Windows credentials from the Credential Manager. Invoke-WCMDump enumerates Windows credentials in the Credential Manager and then extracts available information about each one. Passwords are retrieved for "Generic" type credentials, but can not be retrived by the same method for "Domain" type credentials. Credentials are only returned for the current user. Does not require admin privileges!
  • MimiDbg
    • PowerShell oneliner to retrieve wdigest passwords from the memory
  • mimikittenz
    • mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
• Grabbing Useful files
  • BrowserGatherer
    • Fileless Extraction of Sensitive Browser Information with PowerShell
  • SessionGopher
    • SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
  • CC_Checker
    • CC_Checker cracks credit card hashes with PowerShell.
  • BrowserGather
    • Fileless Extraction of Sensitive Browser Information with PowerShell. This project will include various cmdlets for extracting credential, history, and cookie/session data from the top 3 most popular web browsers (Chrome, Firefox, and IE). The goal is to perform this extraction entirely in-memory, without touching the disk of the victim. Currently Chrome credential and cookie extraction is supported.
• Lateral Movement
  • Invoke-CommandAs
    • Invoke Command as System/User on Local/Remote computer using ScheduleTask.
• Malicious X (Document/Macro/whatever) Generation
  • ​psWar.py
  • Code that quickly generates a deployable .war for a PowerShell one-liner
• Obfuscation
  • Invoke-Obfuscation
    • Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator.
    • Presentation
    • Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To) D""eTecT 'Th'+'em'
    • PyFuscation
  • Obfuscate powershell scripts by replacing Function names, Variables and Parameters.
  • Pulling Back the Curtains on EncodedCommand PowerShell Attacks
  • Invoke-CradleCrafter: Moar PowerShell obFUsk8tion by Daniel Bohannon
  • Invoke-CradleCrafter v1.1
  • [invoke-Confusion .NET attacker of Powershell Remotely - homjxl0e]
  • PowerAvails
  • PowerShell Obfuscation using SecureString -
    • TL;DR - PowerShell has built-in functionality to save sensitive plaintext data to an encrypted object called SecureString. Malicious actors have exploited this functionality as a means to obfuscate PowerShell commands. This blog post discusses SecureString, examples seen in the wild, and presents a tool that helps analyse SecureString obfuscated commands.
  • pOWershell obFUsCation - N1CFURY
• Powershell without Powershell
  • Articles/Blogposts/Writeups
    • Empire without PowerShell.exe
    • Powershell without Powershell to bypass app whitelist
    • We don’t need powershell.exe - decoder.cloud
      • Part 2
      • Part 3
    • PowerShell: In-Memory Injection Using CertUtil.exe
    • Run PowerShell without Powershell.exe — Best tools & techniques - Bank Security
  • Talks & Presentations
  • Tools
    • PowerLessShell
      • PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.
    • NoPowerShell
      • NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. No System.Management.Automation.dll is used; only native .NET libraries. An alternative usecase for NoPowerShell is to launch it as a DLL via rundll32.exe: rundll32 NoPowerShell.dll,main.
    • p0wnedShell
      • p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET).
    • UnmanagedPowerShell
    • nps - Not PowerShell
      • Execute powershell without powershell.exe
    • PSShell
      • PSShell is an application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET). It doesn't need to be "installed" so it's very portable.
    • PowerShdll
      • Run PowerShell with rundll32. Bypass software restrictions.
    • PowerOPS: PowerShell for Offensive Operations
    • PowerOPS Github page
      • PowerOPS is an application written in C# that does not rely on powershell.exe but runs PowerShell commands and functions within a powershell runspace environment (.NET). It intends to include multiple offensive PowerShell modules to make the process of Post Exploitation easier.
    • PowerLine
      • Presentation
      • Running into environments where the use of PowerShell is being monitored or is just flat-out disabled? Have you tried out the fantastic PowerOps framework but are wishing you could use something similar via Meterpreter, Empire, or other C2 channels? Look no further! In this talk, Brian Fehrman talks about his new PowerLine framework. He overviews the tool, walks you through how to use it, shows you how you can add additional PowerShell scripts with little effort, and demonstrates just how powerful (all pun intended) this little program can be!
• Priv Esc / Post Ex Scripts
  • PowerUp
    • PowerUp is a powershell tool to assist with local privilege escalation on Windows systems. It contains several methods to identify and abuse vulnerable services, as well as DLL hijacking opportunities, vulnerable registry settings, and escalation opportunities.
  • Sherlock
    • PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
  • JSRat-Py
    • implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled
  • ps1-toolkit
    • This is a set of PowerShell scripts that are used by many penetration testers released by multiple leading professionals. This is simply a collection of scripts that are prepared and obfuscated to reduce level of detectability and to slow down incident response from understanding the actions performed by an attacker.
• Recon
  • Invoke-ProcessScan
    • Gives context to a system. Uses EQGRP shadow broker leaked list to give some descriptions to processes.
  • Powersploit-PowerView
    • PowerView is a PowerShell tool to gain network situational awareness on Windows domains. It contains a set of pure-PowerShell replacements for various windows "net *" commands, which utilize PowerShell AD hooks and underlying Win32 API functions to perform useful Windows domain functionality.
  • PowerShell-AD-Recon
    • AD PowerShell Recon Scripts
  • PowEnum
    • PowEnum executes common PowerSploit Powerview functions and combines the output into a spreadsheet for easy analysis. All network traffic is only sent to the DC(s). PowEnum also leverages PowerSploit Get-GPPPassword and Harmj0y's ASREPRoast.
• Signatures
  • DigitalSignature-Hijack.ps1
    • Hijack Digital Signatures – PowerShell Script - pentestlab
  • PoCSubjectInterfacePackage
    • A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.
• Miscellaneous Useful Things
  • Invoke-DCOM.ps1
  • PowerShell and Token Impersonation
  • Harness
    • Harness is remote access payload with the ability to provide a remote interactive PowerShell interface from a Windows system to virtually any TCP socket. The primary goal of the Harness Project is to provide a remote interface with the same capabilities and overall feel of the native PowerShell executable bundled with the Windows OS.
  • DPAPI Primer for Pentesters - webstersprodigy
  • PowerHub
    • Webserver frontend for powersploit with functionality and niceness.
  • Invoke-VNC
    • Powershell VNC injector
  • Invoke-BSOD
    • A PowerShell script to induce a Blue Screen of Death (BSOD) without admin privileges. Also enumerates Windows crash dump settings. This is a standalone script, it does not depend on any other files.
  • Invoke-SocksProxy
    • Creates a Socks proxy using powershell.
  • OffensivePowerShellTasking
    • Run multiple PowerShell scripts concurrently in different app domains. Solves the offensive security problem of running multiple PowerShell scripts concurrently without spawning powershell.exe and without the scripts causing problems with each other (usually due to PInvoke'd functions).
  • PowerShell-Suite
    • There are great tools and resources online to accomplish most any task in PowerShell, sometimes however, there is a need to script together a util for a specific purpose or to bridge an ontological gap. This is a collection of PowerShell utilities I put together either for fun or because I had a narrow application in mind. - b33f
  • Powershell-SSHTools
    • A bunch of useful SSH tools for powershell
  • Utilities
    • 7Zip4Powershell
      • Powershell module for creating and extracting 7-Zip archives
  • Servers
    • Dirty Powershell Webserver
    • Pode
      • Pode is a PowerShell framework that runs HTTP/TCP listeners on a specific port, allowing you to host REST APIs, Web Pages and SMTP/TCP servers via PowerShell. It also allows you to render dynamic HTML using PSHTML files.

---

Post-Exploitation

---

General Post Exploitation

• Tactics
  • Adversarial Post Ex - Lessons from the Pros
  • Meta-Post Exploitation - Using Old, Lost, Forgotten Knowledge
  • Operating in the Shadows - Carlos Perez - DerbyCon(2015)
  • RTLO-attack
    • This is a really simple example on how to create a file with a unicode right to left ove rride character used to disguise the real extention of the file. In this example I disguise my .sh file as a .jpg file.
  • Blog
  • IPFuscator
    • IPFuscation is a technique that allows for IP addresses to be represented in hexadecimal or decimal instead of the decimal encoding we are used to. IPFuscator allows us to easily convert to these alternative formats that are interpreted in the same way.
    • Blogpost
  • Cuteit
    • A simple python tool to help you to social engineer, bypass whitelisting firewalls, potentially break regex rules for command line logging looking for IP addresses and obfuscate cleartext strings to C2 locations within the payload.
• Egress Testing
  • Egress Testing using PowerShell
  • Egress Buster Reverse Shell
    • Egress Buster Reverse Shell – Brute force egress ports until one if found and execute a reverse shell(from trustedsec)
  • Egress-Assess
    • Egress-Assess is a tool used to test egress data detection capabilities
• Execution
  • Shellpaste
    • Tiny snippet of code that pulls ASCII shellcode from pastebin and executes it. The purpose of this is to have a minimal amount of benign code so AV doesn't freak out, then it pulls down the evil stuff. People have been doing this kind of stuff for years so I take no credit for the concept. That being said, this code (or similar code) works surprisingly often during pentests when conventional malware fails.
• File Transfer
  • Platform-Neutral
    • Updog
      • Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use http basic auth.
    • File transfer skills in the red team post penetration test - xax007
    • (Almost) All The Ways to File Transfer - PenTest-Duck
    • ffsend
      • Easily and securely share files and directories from the command line through a safe, private and encrypted link using a single simple command. Files are shared using the Send service and may be up to 1GB (2.5GB authenticated). Others are able to download these files with this tool, or through their web browser.
  • Linux
  • Mac OS
  • Windows
    • WMI & PowerShell: An Introduction to Copying Files - FortyNorthSecurity
• Persistence
  • List of low-level attacks/persistence techniques. HIGHLY RECOMMENDED!
  • How to Remotely Control Your PC (Even When it Crashes)
  • Backdooring X
    • Introduction to Manual Backdooring - abatchy17
    • Backdooring PE-File (with ASLR) - hansesecure.de
      • Simple codecave
    • An Introduction to Backdooring Operating Systems for Fun and trolling - Defcon22
  • Building a backdoored Binary
    • Pybuild
      • PyBuild is a tool for automating the pyinstaller method for compiling python code into an executable. This works on Windows, Linux, and OSX (pe and elf formats)(From trustedsec)
  • PYTHONPATH
    • I'm In Your $PYTHONPATH, Backdooring Your Python Programs
    • Pyekaboo
      • Pyekaboo is a proof-of-concept program that is able to to hijack/hook/proxy Python module(s) thanks to $PYTHONPATH variable. It's like "DLL Search Order Hijacking" for Python.
• Defense Evasion
• Credential Access
  • Keyloggers
    • HeraKeylogger
      • Chrome Keylogger Extension
    • Meltdown PoC for Reading Google Chrome Passwords
• Discovery
  • Packet Sniffing
    • See Network_Attacks.md
  • Finding your external IP:
    • Curl any of the following addresses: ident.me, ifconfig.me or whatsmyip.akamai.com
    • Determine Public IP from CLI
  • Virtual Machine Detection(VM Dection)
    • How to determine Linux guest VM virtualization technology
    • Virtualbox
      • VirtualBox Detection Via WQL Queries
      • Bypassing VirtualBox Process Hardening on Windows
      • VBoxHardenedLoader
        • VirtualBox VM detection mitigation loader
• Lateral Movement
  • Browser Pivoting
    • Browser Pivot for Chrome - ijustwannaredteam
      • Today’s post is about Browser Pivoting with Chrome. For anyone unaware of Browser Pivoting, it’s a technique which essentially leverages an exploited system to gain access to the browser’s authenticated sessions. This is not a new technique, in fact, Raphael Mudge wrote about it in 2013. Detailed in the linked post, the Browser Pivot module for Cobalt Strike targets IE only, and as far as I know, cannot be used against Chrome. In this post we’re trying to achieve a similar result while taking a different approach – stealing the target’s Chrome profile in real time. Just a FYI, if you have the option to use Cobalt Strike’s Browser Pivot module instead, do so, it’s much cleaner.
    • Pass the Cookie and Pivot to the Clouds - wunderwuzzi
      • An adversary can pivot from a compromised host to Web Applications and Internet Services by stealing authentication cookies from browsers and related processes. At the same time this technique bypasses most multi-factor authentication protocols.
• Collection
  • Tools
    • LaZagne
      • The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software.
    • DumpsterDiver
      • DumpsterDiver is a tool used to analyze big volumes of various file types in search of hardcoded secrets like keys (e.g. AWS Access Key, Azure Share Key or SSH keys) or passwords. Additionally, it allows creating a simple search rules with basic conditions (e.g. reports only csv file including at least 10 email addresses). The main idea of this tool is to detect any potential secret leaks. You can watch it in action in the demo video or read about all its features in this article.
    • SharpCloud
      • SharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.
    • Packet sniffing with powershell
• Miscellaneous
  • Redis
    • Redis post-exploitation - Pavel Toporkov(ZeroNights18)
      • We will overview the techniques of redis post-exploitation and present new ones. In the course of the talk, you will also find out what to do if a pentester or adversary has obtained access to redis.
• Unsorted
  • portia
    • Portia aims to automate a number of techniques commonly performed on internal network penetration tests after a low privileged account has been compromised.
  • JVM Post-Exploitation One-Liners
  • Oneliner-izer
    • Convert any Python file into a single line of code which has the same functionality.

---

Post-Exploitation Linux

• 101
  • More on Using Bash's Built-in /dev/tcp File (TCP/IP)
  • Bash Brace Expansion Cleverness - Jon Oberhide
  • Basic Linux Privilege Escalation - g0tmi1k
    • Not so much a script as a resource, g0tmi1k’s blog post here has led to so many privilege escalations on Linux system’s it’s not funny. Would definitely recommend trying out everything on this post for enumerating systems.
• Execution
  • General Articles/Blogposts/Writeups
    • needle - Linux x86 run-time process manipulation(paper)
  • Tools
    • GTFOBins
      • GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. The project collects legitimate functions of Unix binaries that can be abused to break out of restricted shells, escalate or maintain elevated privileges, transfer files, spawn bind and reverse shells, and facilitate the other post-exploitation tasks.
    • GTFOPlus
      • GTFOPlus is a helper script that relies on the GTFOBins repo to identify standard Linux binaries that could assist with privilege escalation.
    • fireELF
      • fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfd_create' which is a new way to run linux elf executables completely from memory, without having the binary touch the harddrive.
    • Orc
      • Orc is a post-exploitation framework for Linux written in Bash
    • msf-elf-in-memory-execution
      • Post module for Metasploit to execute ELF in memory
  • CLI
    • Articles/Blogposts/Writeups
  • Exploitation for Client Execution
    • Articles/Blogposts/Writeups
  • GUI
    • Articles/Blogposts/Writeups
  • Local Job Scheduling
    • Articles/Blogposts/Writeups
  • Scripting
    • Articles/Blogposts/Writeups
  • Source
    • Articles/Blogposts/Writeups
  • Space after Filename
    • Articles/Blogposts/Writeups
  • Third-Party Software
    • Articles/Blogposts/Writeups
  • Trap
    • Articles/Blogposts/Writeups
  • User Execution
    • Articles/Blogposts/Writeups
      • Introducing tmpnix - an alternative to static binaries for post exploitation - shiftordie.de
      • A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux - muppetlabs
      • In-Memory-Only ELF Execution (Without tmpfs) - Stuart
      • No one expect command execution!
        • Command execution through native utilities
• Persistence
  • .bash_profile and .bashrc
  • Bootkit
  • Browser Extensions
  • Create Account
  • Hidden Files and Directories
  • Kernel Modules and Extensions
  • Local Job Scheduling
    • Cron
    • Systemd
  • Port Knocking
  • Redundant Access
  • Server Software Component
  • Setuid and Setgid
  • Supply-Chain
    • Debinject
      • Inject malicious code into .debs
  • Systemd Service
  • Trap
  • Vaid Accounts
  • Web Shell
• Privilege Escalation
  • 101
    • Basic Linux Privilege Escalation - g0tm1lk
    • Windows / Linux Local Privilege Escalation Workshop
    • AllTheThings - Linux PrivEsc
  • Articles/Blogposts/Writeups
    • How I did not get a shell - NCCGroup
    • Linux: VMA use-after-free via buggy vmacache_flush_all() fastpath - projectzero
    • Attack and Defend: Linux Privilege Escalation Techniques of 2016
    • [Privilege Escalation - ]
  • Exploits
    • Docker
    • Dirty COW
      • DirtyCow.ninja
    • Huge Dirty COW
      • “Huge Dirty COW” (CVE-2017–1000405) The incomplete Dirty COW patch - Eylon Ben Yaakov
      • HugeDirtyCow PoC
        • A POC for the Huge Dirty Cow vulnerability (CVE-2017-1000405)
    • dirty_sock
    • dirty_sock - Linux privilege escalation exploit via snapd (CVE-2019-7304)
      • In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. For a detailed walkthrough of the vulnerability and the exploit, please refer to the blog posting here.
      • Linux Privilege Escalation via snapd (dirty_sock exploit)
    • Kernel-based
    • Miscellaneous Software
      • Vim/Neovim Arbitrary Code Execution via Modelines - CVE-2019-12735
        • Vim before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code execution via modelines by opening a specially crafted text file.
      • [0day] [exploit] Compromising a Linux desktop using... 6502 processor opcodes on the NES?! - scarybeastsecurity
        • A vulnerability and a separate logic error exist in the gstreamer 0.10.x player for NSF music files. Combined, they allow for very reliable exploitation and the bypass of 64-bit ASLR, DEP, etc. The reliability is provided by the presence of a turing complete “scripting” inside a music player. NSF files are music files from the Nintendo Entertainment System. Curious? Read on...
      • systemd (systemd-tmpfiles) < 236 - 'fs.protected_hardlinks=0' Local Privilege Escalation
  • Techniques
    • Container-based
      • Using the docker command to root the host (totally not a security issue)
        • It is possible to do a few more things more with docker besides working with containers, such as creating a root shell on the host, overwriting system configuration files, reading restricted stuff, etc.
      • Linux Privilege Escalation via LXD & Hijacked UNIX Socket Credentials - Chris Moberly
    • Capabilities
      • An Interesting Privilege Escalation vector (getcap/setcap) - nxnjz
      • Linux Privilege Escalation using Capabilities - Raj Chandel
    • Cron jobs
      • Linux Privilege Escalation by Exploiting Cronjobs - Raj Chandel
      • Linux Privilege Escalation by Exploiting Cronjobs - ArmourInfoSec
      • Day 40: Privilege Escalation (Linux) by Modifying Shadow File for the Easy Win - int0x33
    • Exploitation for Privilege Escalation
    • GTFOBins
    • NFS
      • Linux Privilege Escalation using weak NFS permissions - Haider Mahmood
      • Linux Privilege Escalation using Misconfigured NFS - Raj Chandel
      • NFS weak permissions(Linux Privilege Escalation) - Touhid Shaikh
      • NFS, no_root_squash and SUID - Basic NFS Security - fullyautolinux
      • A tale of a lesser known NFS privesc - gquere
      • NFS - myexperiments.io
    • PATH
      • Abusing users with '.' in their PATH: - gimboyd
    • Process Injection
      • Shared Libraries
    • Setuid and Setgid
      • SUID - myexperiments.io
      • SUID Executables - NetbiosX
      • Tools
        • SUID3NUM
          • A standalone python script which utilizes python's built-in modules to find SUID bins, separate default bins from custom bins, cross-match those with bins in GTFO Bin's repository & auto-exploit those, all with colors! ( ͡ʘ ͜ʖ ͡ʘ)
    • Sudo
      • Dangerous Sudoers Entries – Series, 5 parts
      • sudo - myexperiments.io
    • Sudo Caching
    • Valid Accounts
    • Web Shell
    • Wildcards
      • Back To The Future: Unix Wildcards Gone Wild - Leon Juranic
      • wildpwn
    • Writable Files
      • uptux
        • Linux privilege escalation checks (systemd, dbus, socket fun, etc)
  • Solaris
    • uid=0 is deprecated: A trick unix-privesc-check doesn’t yet know - TMB
    • dtappgather-poc.sh
      • Exploit PoC reverse engineered from EXTREMEPARR which provides local root on Solaris 7 - 11 (x86 & SPARC). Uses a environment variable of setuid binary dtappgather to manipulate file permissions and create a user owned directory anywhere on the system (as root). Can then add a shared object to locale folder and run setuid binaries with an untrusted library file.
  • Talks/Videos
    • Chw00t: Breaking Unixes’ Chroot Solutions
  • Tools
    • LinEnum
      • This tool is great at running through a heap of things you should check on a Linux system in the post exploit process. This include file permissions, cron jobs if visible, weak credentials etc. The first thing I run on a newly compromised system.
    • Linux_Exploit_Suggester
      • Linux Exploit Suggester; based on operating system release number. This program run without arguments will perform a 'uname -r' to grab the Linux Operating Systems release version, and return a suggestive list of possible exploits. Nothing fancy, so a patched/back-ported patch may fool this script. Additionally possible to provide '-k' flag to manually enter the Kernel Version/Operating System Release Version.
    • linux-exploit-suggester
      • Linux privilege escalation auditing tool
    • LinuxPrivChecker
      • This is a great tool for once again checking a lot of standard things like file permissions etc. The real gem of this script is the recommended privilege escalation exploits given at the conclusion of the sc
      • Github
    • Unix Privilege Escalation Checker
      • Unix-privesc-checker is a script that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases). It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).
    • EvilAbigail
      • Initrd encrypted root fs attack
    • kernelpop
      • kernel privilege escalation enumeration and exploitation framework
• Defense Evasion
  • Binary Padding
  • Clear Command History
  • Compile After Delivery
  • Connection Proxy
  • Disabling Security Tools
  • Execution Guardrails
  • Exploitation for Defense Evasion
  • File and Directory Permissions Modification
  • File Deletion
  • Hidden Files and Directories
  • HISTCONTROL
  • Indicator Removal from Tools
  • Indicator Removal on Host
  • Install Root Certificate
  • Masquerading
  • Obfuscated Files or Information
  • Port Knocking
  • Process Injection
  • Redundant Access
  • Rootkit
  • Scripting
  • Space after Filename
  • Timestomp
  • Valid Accounts
  • Web Service
• Credential Access
  • Bash History
    • Articles/Blogposts
    • Tools
  • Brute Force
    • Articles/Blogposts
    • Tools
  • Credential Dumping
    • Articles/Blogposts
      • Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX - Tim(-Wadha) Brown
        • What this talk is about: Why a domain joined UNIX box matters to Enterprise Admins; How AD based trust relationships on UNIX boxes are abused; How UNIX admins can help mitigate the worst side effects;
      • Kerberos Credential Thiever (GNU/Linux) - Ronan Loftus, Arne Zismer
        • Kerberos is an authentication protocol that aims to reduce the amount of sensitive data that needs to be sent across a network with lots of network resources that require authentication. This reduces the risk of having authentication data stolen by an attacker. Network Attached Storage devices, big data processing applications like Hadoop, databases and web servers commonly run on GNU/Linux machines that are integrated in a Kerberos system. Due to the sensitivity of the data these services deal with, their security is of great importance. There has been done a lot of research about sniffing and replaying Kerberos credentials from the network. However, little work has been done on stealing credentials from Kerberos clients on GNU/Linux. We therefore investigate the feasibility of extracting and reusing Kerberos credentials from GNU/Linux machines. In this research we show that all the credentials can be extracted, independently of how they are stored on the client. We also show how these credentials can be reused to impersonate the compromised client. In order to improve the security of Kerberos, we also propose mitigations to these attacks.
      • Exfiltrating credentials via PAM backdoors & DNS requests - x-c3ll
    • Tools
      • linikatz
      • mimipenguin
        • A tool to dump the login password from the current linux user
      • 3snake
        • Targeting rooted servers, reads memory from sshd and sudo system calls that handle password based authentication. Doesn't write any memory to the traced processes. Spawns a new process for every sshd and sudo command that is run. Listens for the proc event using netlink sockets to get candidate processes to trace. When it receives an sshd or sudo process ptrace is attached and traces read and write system calls, extracting strings related to password based authentication.
      • Tickey
        • Tool to extract Kerberos tickets from Linux kernel keys. Paper
  • Credentials from Web Browsers
    • Articles/Blogposts
    • Tools
  • Credentials in Files
    • Articles/Blogposts
      • Digging passwords in Linux swap
    • Tools
      • KeyTabExtract
        • KeyTabExtract is a little utility to help extract valuable information from 502 type .keytab files, which may be used to authenticate Linux boxes to Kerberos. The script will extract information such as the realm, Service Principal, Encryption Type and NTLM Hash.
      • swap_digger
        • swap_digger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc.
  • Exploitation for Credential Access
    • Articles/Blogposts
      • Triple-Fetch-Kernel-Creds
        • Attempt to steal kernelcredentials from launchd + task_t pointer (Based on: CVE-2017-7047)
    • Tools
  • Input Capture
    • Articles/Blogposts
    • Tools
      • SudoHulk
        • This tool change sudo command, hooking the execve syscall using ptrace, tested under bash and zsh
  • Network Sniffing
    • Articles/Blogposts
    • Tools
  • Private Keys
    • Articles/Blogposts
    • Tools
  • Steal Web Session Cookie
    • Articles/Blogposts
    • Tools
  • Two-Factor Authentication Interception
    • Articles/Blogposts
    • Tools
• Discovery
  • Articles/Blogposts/Writeups
  • Account Discovery
  • Browser Bookmark Discovery
  • File and Directory Discovery
  • Network Service Scanning
    • Articles/Blogposts/Writeups
      • Finding DNS servers provided by DHCP using network manager on Linux -ilostmynotes.blogspot
    • Tools
      • Baboossh
        • BabooSSH allows you, from a simple SSH connection to a compromised host, to quickly gather info on other SSH endpoints to pivot and compromise them.
  • Network Sniffing
  • Password Policy Discovery
  • Permission Groups Discovery
  • Process Discovery
    • Articles/Blogposts/Writeups
    • Tools
      • pspy
        • pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. The tool gathers the info from procfs scans. Inotify watchers placed on selected parts of the file system trigger these scans to catch short-lived processes.
  • Remote System Discovery
    • nullinux
      • nullinux is an internal penetration testing tool for Linux that can be used to enumerate OS information, domain information, shares, directories, and users through SMB. If no username and password are provided, nullinux will attempt to connect to the target using an SMB null session. Unlike many of the enumeration tools out there already, nullinux can enumerate multiple targets at once and when finished, creates a users.txt file of all users found on the host(s). This file is formatted for direct implementation and further exploitation.This program assumes Python 2.7, and the smbclient package is installed on the machine. Run the setup.sh script to check if these packages are installed.
  • Software Discovery
  • System Information Discovery
    • LinEnum
  • System Network Configuration Discovery
  • System Network Connections Discovery
  • System Owner/User Discovery
• Lateral Movement
  • Application Deployment Software
  • Exploitation of Remote Services
  • Internal Spearphishing
  • Port Forwarding & Proxies
    • PortPush
      • PortPush is a small Bash utility used for pivoting into internal networks upon compromising a public-facing host.
  • Remote File Copy
  • Remote Services
    • RDP
      • The RDP Through SSH Encyclopedia - Carrie Roberts
        • I have needed to remind myself how to set up RDP access through an SSH connection so many times that I’ve decided to document it here for future reference. I hope it proves useful to you as well. I do “adversary simulation” for work and so I present this information using terms like “attacker” and “target” but this info is also useful for performing system administration tasks.
    • SSH
      • Secure Shell - Wikipedia
      • SSH manpage
      • SSH Essentials: Working with SSH Servers, Clients, and Keys - Justin Ellingwood
      • An SSH tunnel via multiple hops - stackoverflow
  • SSH Hijacking
  • Third-party Software
• Collection

  • Audio Capture

  • Automated Collection

  • Clipboard Data

  • Data from Information Repositories

  • Data from Local System

    • Tools
      • swap_digger
        • swap_digger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc.

  • Data from Network Shared Drive

  • Data from Removable Media

  • Data Staged

  • Input Capture

  • Screen Capture

---

Post-Exploitation OS X

• Educational
  • Articles/Blogposts/Writeups
    • The ‘app’ you can’t trash: how SIP is broken in High Sierra
    • I can be Apple, and so can you - A Public Disclosure of Issues Around Third Party Code Signing Checks - Josh Pitts
  • Talks/Presentations/Videos
    • The Mouse is Mightier than the Sword - Patrick Wardle
      • In this talk we'll discuss a vulnerability (CVE-2017-7150) found in all recent versions of macOS that allowed unprivileged code to interact with any UI component including 'protected' security dialogues. Armed with the bug, it was trivial to programmatically bypass Apple's touted 'User-Approved Kext' security feature, dump all passwords from the keychain, bypass 3rd-party security tools, and much more! And as Apple's patch was incomplete (surprise surprise) we'll drop an 0day that (still) allows unprivileged code to post synthetic events and bypass various security mechanisms on a fully patched macOS box!
    • Fire & Ice; Making and Breaking macOS firewalls - Patrick Wardle(Rootcon12)
      • Slides
    • When Macs Come Under ATT&CK - Richie Cyrus(Derbycon2018)
      • Macs are becoming commonplace in corporate environments as a alternative to Windows systems. Developers, security teams, and executives alike favor the ease of use and full administrative control Macs provide. However, their systems are often joined to an active directory domain and ripe for attackers to leverage for initial access and lateral movement. Mac malware is evolving as Mac computers continue to grow in popularity. As a result, there is a need for proactive detection of attacks targeting MacOS systems in a enterprise environment. Despite advancements in MacOS security tooling for a single user/endpoint, little is known and discussed regarding detection at a enterprise level. This talk will discuss common tactics, techniques and procedures used by attackers on MacOS systems, as well as methods to detect adversary activity. We will take a look at known malware, mapping the techniques utilized to the MITRE ATT&CK framework. Attendees will leave equipped to begin hunting for evil lurking within their MacOS fleet.
    • Harnessing Weapons of Mac Destruction - Patrick Wardle
    • Herding cattle in the desert: How malware actors have adjusted to new security enhancements in Mojave - Omer Zohar
      • Slides
      • In this talk, we’ll deep dive into recent security changes in MacOS Mojave & Safari and examine how these updates impacted actors of highly distributed malware in terms of number of infections, and more importantly - monetization. We’ll take a look at malware actors currently infecting machines in the wild (Bundlore and Genio to name a few) - and investigate how their tactics evolved after the update: From vectors of infection that bypass Gatekeeper, getting around the new TCC dialogs, hijacking search in a SIP protected Safari, to persistency and reinfection mechanisms that ultimately turn these ‘annoying PUPs’ into a fully fledged backdoored botnet.
    • Never Before Had Stierlitz Been So Close To Failure (Sergei Shevchenko(OBTS v2.0)
      • Slides
      • In this research, we'll dive into the installer's Mach-O binary to demonstrate how it piggy-backs on 'non-lazy' Objective-C classes, the way it dynamically unpacks its code section in memory and decrypts its config. An in-depth analysis will reveal the structure of its engine and a full scope of its hidden backdoor capabilities, anti-debugging, VM evasion techniques and other interesting tricks that are so typical to the Windows malware scene but aren’t commonly found in the unwanted apps that claim to be clean, particularly on the Mac platform. This talk reveals practical hands-on tricks used in Mach-O binary analysis under a Hackintosh VM guest, using LLDB debugger and IDA Pro disassembler, along with a very interesting marker found during such analysis. Curious to learn what that marker was? Willing to see how far the Mac-specific techniques evolved in relation to Windows malware?
    • An 0day in macOS - Patrick Wardle(OBTSv2.0)
      • Slides
      • Let's talk about a powerful 0day in macOS Mojave.
• Execution
  • General
    • Weaponizing a Lazarus Group Implant - Patrick Wardle(2020)
      • repurposing a 1st-stage loader, to execute custom 'fileless' payloads
  • AppleScript
    • 101
      • AppleScript Language Guide - developer.apple
      • AppleScript Fundamentals - developer.apple
        • Section from the Language Guide
      • AppleScript - William R. Cook(2006)
      • Scripting with AppleScript - developer.apple
        • The following is a brief introduction to AppleScript scripts, tools for working with them, and information on using AppleScript scripts together with other scripting systems. For related documents, see the learning paths in Getting Started with AppleScript.
      • AppleScript: The Definitive Guide, 2nd Edition - Matt Neuburg
    • Articles/Blogposts/Writeups
      • macOS Red Team: Spoofing Privileged Helpers (and Others) to Gain Root - Phil Stokes
      • macOS Red Team: Calling Apple APIs Without Building Binaries - Phil Stokes
      • Launch Scripts from Webpage Links - macosxautomation.com
      • Using NSAppleScript - appscript.sourceforge
      • hello, applescript 2: user in, user out - philastokes(applehelpwriter.com)
      • hello, applescript 3: (don’t?) tell me to run - philastokes(appplehelpwriter)
    • Tools
  • Command-Line Interface
    • Articles/Blogposts/Writeups
      • ShellOut
        • Easily run shell commands from a Swift script or command line tool
    • Tools
  • Exploitation for Client Execution
    • Articles/Blogposts/Writeups
    • Tools
  • Graphical User Interface
    • Articles/Blogposts/Writeups
    • Tools
  • Launchctl
    • Articles/Blogposts/Writeups
    • Tools
  • Local Job Scheduling
    • Articles/Blogposts/Writeups
    • Tools
  • Javascript for Automation(JXA)
    • Orchard
      • Live off the land for macOS. This program allows users to do Active Directory enumeration via macOS JXA (JavaScript for Automation) code. This is the newest version of AppleScript, and thus has very poor documentation on the web.
    • Talks/Presentations/Videos
      • Bash-ing Brittle Indicators: Red Teaming macOS without Bash or Python - Cody Thomas(Objective by the Sea v2.0)
        • Slides
        • In this talk, I'll go into the research, development, and usage of a new kind of agent based on JavaScript for Automation (JXA) and how it can be used in modern red teaming operations. This agent is incorporated into a broader open source project designed for collaborative red teaming I created called Apfell. I will discuss TTPs for doing reconnaissance, persistence, injection, and some keylogging all without using a shell command or spawning another scripting language. I will go into details of how JXA can be used to create an agent complete with encrypted key exchange for secure communications, domain fronting C2, and modular design to load or change key functionality on the fly. I will also cover the defensive considerations of these TTPs and how Apple is starting to secure these capabilities going forward.
  • Scripting
    • Articles/Blogposts/Writeups
    • Tools * Source
  • Space after Filename
    • Articles/Blogposts/Writeups
    • Tools * Third-party Software
  • Trap
    • Articles/Blogposts/Writeups
    • Tools
  • User Execution
    • Articles/Blogposts/Writeups
      • Native Mac OS X Application / Mach-O Backdoors for Pentesters
    • Tools
      • HappyMac
        • A Python Mac app to suspend background processes
      • Platypus
        • Platypus is a developer tool that creates native Mac applications from command line scripts such as shell scripts or Python, Perl, Ruby, Tcl, JavaScript and PHP programs. This is done by wrapping the script in an application bundle along with a slim app binary that runs the script.
  • URL Schemes/Routing
    • Articles/Blogposts/Writeups
      • URL Routing on macOS - Florian Schliep
      • Remote Mac Exploitation Via Custom URL Schemes - Patrick Wardle(2018)
    • Tools
  • Tools
    • Mouse
      • Mouse Framework is an iOS and macOS post-exploitation framework that gives you a command line session with extra functionality between you and a target machine using only a simple Mouse Payload. Mouse gives you the power and convenience of uploading and downloading files, tab completion, taking pictures, location tracking, shell command execution, escalating privileges, password retrieval, and much more.
    • Appfell
      • A collaborative, multi-platform, red teaming framework
    • MacShell Post Exploitation Tool - Cedric Owens
    • MacShell
      • MacShell is a macOS post exploitation tool written in python using encrypted sockets. I wrote this tool as a way for defenders and offensive security researchers to more easily understand the inner workings of python-based post exploitation tools on macOS.
    • MacShellSwift
      • MacShellSwift is a proof of concept MacOS post exploitation tool written in Swift using encrypted sockets. I rewrote a prior tool of mine MacShell (one of my repos) and changed the client to Swift intstead of python. This tool consists of two parts: a server script and a client binary. I wrote this tool to help blue teamers proactively guage detections against macOS post exploitation methods that use macOS internal calls. Red teams can also find this of use for getting ideas around using Swift for macOS post exploitation.
    • EvilOSX
      • An evil RAT (Remote Administration Tool) for macOS / OS X.
    • Parasite
      • Parasite is a powerful code insertion platform for OS X. It enables developers to easily create extensions which change the original behavior of functions. For users Parasite provides an easy way to install these extensions and tweak their OS.
    • EvilOSX
      • An evil RAT (Remote Administration Tool) for macOS / OS X.
• Persistence
  • General
    • Articles/Blogposts/Writeups
      • Methods Of Malware Persistence On Mac OS X
      • How Malware Persists on macOS - Phil Stokes
      • What's the easiest way to have a script run at boot time in OS X? - Stack Overflow
  • Presentations/Talks/Videos
    • Userland Persistence On Mac Os X "It Just Works" - Shmoocon 2015
      • Got root on OSX? Do you want to persist between reboots and have access whenever you need it? You do not need plists, new binaries, scripts, or other easily noticeable techniques. Kext programming and kernel patching can be troublesome! Leverage already running daemon processes to guarantee your access. As the presentation will show, if given userland administrative access (read: root), how easy it is to persist between reboots without plists, non-native binaries, scripting, and kexts or kernel patching using the Backdoor Factory.
  • .bash_profile and .bashrc
  • Browser Extensions
  • Create Account
  • Dylib Hijacking
  • Emond
  • Folder Actions
    • Folder Actions for Persistence on macOS - Cody Thomas
  • Hidden Files and Directories
  • Kernel Modules and Extensions
  • Launch Agent
  • Launch Daemon
  • Launchctl
  • LC_LOAD_DYLIB Addition
  • Local Job Scheduling
  • Login Item
    • Adding Login Items - developer.apple
    • Open items automatically when you log in on Mac - developer.apple
  • Logon Scripts
  • Mail.app
    • Using email for persistence on OS X - n00py
  • Plist Modification
  • Port Knocking
  • Rc.common
  • Re-opened Applications
  • Redundant Access
  • Setuid and Setgid
  • Startup Items
  • Trap
  • Valid Accounts
  • Web Shell
  • Xcode
    • Running and disguising programs through XCode shims on OS X
  • Tools
    • EvilOSX
      • A pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX.
    • p0st-ex
      • Post-exploitation scripts for OosxpostS X persistence and privesc
• Privilege Escalation
  • General
    • Articles/Blogposts/Writeups
      • Hidden backdoor API to root privileges in Apple OS X
        • The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It’s been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to escalate privileges to root from any user account in the system. The intention was probably to serve the “System Preferences” app and systemsetup (command-line tool), but any user process can use the same functionality. Apple has now released OS X 10.10.3 where the issue is resolved. OS X 10.9.x and older remain vulnerable, since Apple decided not to patch these versions. We recommend that all users upgrade to 10.10.3.
        • Works on 10.7 -> 10.10.2
    • Presentations/Talks/Videos
      • Hacking Exposed: Hacking Macs - RSA Keynote, George Kurtz and Dmitri Alperovitch, Part 1 "Delivery"(2019)
        • CrowdStrike Co-founders, CEO George Kurtz and CTO Dmitri Alperovitch, and Falcon OverWatch Senior Engineer Jaron Bradley demonstrate a “Delivery” stage attack against a MacOS system. This demo is from their RSA 2019 keynote address titled, “Hacking Exposed: Hacking Macs.”
      • Hacking Macs from RSA- George Kurtz and Dmitri Alperovitch, Part 2 "Privilege Escalation"
        • CrowdStrike Co-founders, CEO George Kurtz and CTO Dmitri Alperovitch, and Falcon OverWatch Senior Engineer Jaron Bradley demonstrate a “Privilege Escalation” stage attack against a MacOS system. This demo is from their RSA 2019 keynote address titled, “Hacking Exposed: Hacking Macs.”
  • Dylib Hijacking
    • Talks/Presentations/Videos
      • Gaining Root with Harmless AppStore Apps - Csaba Fitzi
        • Slides
        • This talk is about my journey from trying to find dylib hijacking vulnerability in a particular application to finding a privilege escalation vulnerability in macOS. During the talk I will try to show the research process, how did I moved from one finding to the next and I will also show many of the failures / dead ends I had during the exploit development.First I will briefly cover what is a dylib hijacking, and what is the current state of various application regarding this type of vulnerability. We will see how hard is to exploit these in many cases due to the fact that root access is required. Second I will cover two seemingly harmless bugs affecting the installation process of AppStore apps, and we will see how can we chain these together in order to gain root privileges - for this we will utilise a completely benign app from the macOS App Store. Part of this I will cover how can we submit apps to the store, and what are the difficulties with that process.In the last part I will cover how we can infect and include our malicious file in an App installer without breaking the App’s signature.
  • Elevated Execution with Prompt
    • Articles/Blogposts/Writeups
      • Elevating Privileges Safely - developer.apple
      • macOS Red Team: Spoofing Privileged Helpers (and Others) to Gain Root - Phil Stokes
      • Privilege escalation on OS X – without exploits - n00py.io
  • Emond
  • Exploitation for Privilege Escalation
    • CVE-2019-8805 - A macOS Catalina privilege escalation - Scott Knight
    • Sniffing Authentication References on macOS - Patrick Wardle(2018)
      • details of a privilege-escalation vulnerability (CVE-2017-7170)
      • The Ugly: for last ~13 years (OSX 10.4+) anybody could locally sniff 'auth tokens' then replay to stealthy & reliably elevate to r00t 🍎🤒☠️ The Bad: reported to Apple -they silently patched it (10.13.1) 🤬 The Good: when confronted they finally assigned CVE + updated docs 😋 [pic.twitter.com/RlNBT1DBvK](pic.twitter.com/RlNBT1DBvK)
    • Mac OS X local privilege escalation (IOBluetoothFamily)
    • How to gain root with CVE-2018-4193 in < 10s - Eloi Benoist-Vanderbeken
    • CVE-2018-4193
      • exploit for CVE-2018-4193
    • Rootpipe
      • Rootpipe Reborn (Part I) - codecolorist
        • CVE-2019-8513 TimeMachine root command injection
      • Rootpipe Reborn (Part II) - codecolorist
        • CVE-2019-8565 Feedback Assistant race condition leads to root LPE
      • Stick That In Your (root)Pipe & Smoke It - Patrick Wardle(Defcon23)
        • Talk
  • Launch Daemon
  • Permissions Misconfiguration
    • Articles/Blogposts/Writeups
      • Exploiting directory permissions on macOS - theevilbit
        • In the following post I will first go over the permission model of the macOS filesystem, with focus on the POSIX part, discuss some of the non trivial cases it can produce, and also give a brief overview how it is extended. I won’t cover every single detail of the permission model, as it would be a topic in itself, but rather what I found interesting from the exploitation perspective. Then I will cover how to find these bugs, and finally I will go through in detail all of the bugs I found. Some of these are very interesting as we will see, as exploitation of them involves “writing” to files owned by root, while we are not root, which is not trivial, and can be very tricky.
    • Talks/Presentations/Videos
      • Root Canal - Samuel Keeley(OBTSv2.0)
        • Slides
        • Apple released System Integrity Protection/rootless with OS X El Capitan almost four years ago.The root account is still there, and many common pieces of software open the Mac up to simple root escalations - including common macOS management tools. How can we detect these vulnerabilities across our Mac fleets? What can root still be abused for in 2019?
  • Plist Modification
  • Privileged File Operations
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
      • Job(s) Bless Us!Privileged Operations on macOS - Julia Vaschenko(OBTSv3.0)
  • Process Injection
    • Articles/Blogposts/Writeups
      • Privilege Escalation on OS X below 10.0
        • CVE-2014-8835
    • Tools
      • osxinj
        • Another dylib injector. Uses a bootstrapping module since mach_inject doesn't fully emulate library loading and crashes when loading complex modules.
  • Setuid and Setgid
  • Startup Items
  • Sudo
  • Sudo Caching
    • tty_tickets option now on by default for macOS Sierra’s sudo tool - rtrouton
    • Privilege escalation on OS X – without exploits - n00py.io
  • Valid Accounts
  • Web Shell
  • SIP Bypass
    • abusing the local upgrade process to bypass SIP - Objective-see
  • Exploits
    • Why <blank> Gets You Root- Patrick Wardle(2017)
      • In case you haven't heard the news, there is a massive security flaw which affects the latest version of macOS (High Sierra). The bug allows anybody to log into the root account with a blank, or password of their choosing. Yikes!
    • macOS 10.13.x SIP bypass (kernel privilege escalation)
      • "Works only on High Sierra, and requires root privilege. It can be chained with my previous local root exploits."
      • Slides
    • IOHIDeous(2017)
      • Code
      • A macOS kernel exploit based on an IOHIDFamily 0day.
  • Talks/Presentations/Videos
    • Death By 1000 Installers on macOS and it's all broken! - Patrick Wardle(Defcon25)
      • Slides
    • Attacking OSX for fun and profit tool set limiations frustration and table flipping Dan Tentler - ShowMeCon
      • 'I was approached by Fusion to be part of their 'Real Future' documentary - specifically, and I quote, to 'see how badly I could fuck his life up, while having control of his laptop'. They wanted me to approach this scenario from how a typical attacker wou'
  • Tools
    • BigPhish
      • This issue has been resolved by Apple in MacOS Sierra by enabling tty_tickets by default. NOTE: All other MacOS operation system (El Capitan, Yosemite, Mavericks etc...) still remain vulnerable to this exploit.
• Defense Evasion
  • 101
    • App security overview - support.apple
    • Protecting against malware - support.apple
    • Gatekeeper and runtime protection - support.apple
  • Endpoint Security
    • EndpointSecurity - developer.apple
      • Endpoint Security is a C API for monitoring system events for potentially malicious activity. Your client, which you can write in any language supporting native calls, registers with Endpoint Security to authorize pending events, or receive notifications of events that have already occurred. These events include process executions, mounting file systems, forking processes, and raising signals. Develop your system extension with Endpoint Security and package it in an app that uses the SystemExtensions framework to install and upgrade the extension on the user’s Mac.
  • Gatekeeper
    • Gatekeeper - Wikipedia
    • Gatekeeper Bypass - ATT&CK
    • Safely open apps on your Mac - support.apple
      • 'macOS includes a technology called Gatekeeper, that's designed to ensure that only trusted software runs on your Mac.'
    • Launch Service Keys - LSFileQuarantineEnabled
    • macOS Code Signing In Depth - developer.apple
    • GateKeeper - Bypass or not bypass? - theevilbit(2019)
    • How WindTail and Other Malware Bypass macOS Gatekeeper Settings - Phil Stokes
    • MacOS X GateKeeper Bypass - Filippo Cavallarin(2019)
  • System Integrity Protection(SIP)
    • System Integrity Protection - Wikipedia
    • About System Integrity Protection on your Mac - support.apple.com
    • Configuring System Integrity Protection - developer.apple
    • Bypassing Apple's System Integrity Protection - Patrick Wardle › abusing the local upgrade process to bypass SIP]
    • Bad Things in Small Packages - Jaron Bradley
      • Slides
      • This talk will primarily focus on the work that went into discovering CVE-2019-8561. The vulnerability exists within PackageKit that could lead to privilege escalation, signature bypassing, and ultimately the bypassing of Apple's System Integrity Protection (SIP). This vulnerability was patched in macOS 10.14.4, but the details behind this exploit have not been documented anywhere prior to this conference!
  • XProtect
    • XProtect Explained: How Your Mac’s Built-in Anti-malware Software Works - Chris Hoffman(2015)
    • How the “antimalware” XProtect for MacOS works and why it detects poorly and badly - ElevenPaths(2019)
    • How To Bypass XProtect on Catalina - Phil Stokes
    • XProtect
      • This repo contains historical releases of the XProtect configuration data.
• Credential Access
  • Cracking Password Hashes
    • Articles/Blogposts/Writeups
      • How to extract hashes and crack Mac OS X Passwords - onlinehashcrack.com
      • How to Hack a Mac Password Without Changing It - Tokyoneon
      • Mac OSX Password Cracking - mcontino(2017)
      • What type of hash are a Mac's password stored in? - AskDifferent
        • Check the first answer
      • Cracking Mac OS Lion Passwords - frameloss.org(2011)
    • Tools
      • DaveGrohl 3.01 alpha
        • A Password Cracker for OS X
  • Bash History
    • Articles/Blogposts/Writeups
  • Brute Force
    • Articles/Blogposts/Writeups
    • Tools
  • Credential Dumping
    • Articles/Blogposts/Writeups
      • Getting What You’re Entitled To: A Journey Into MacOS Stored Credentials - MDSec(2020)
        • In this blog post we will explore how an operator can gain access to credentials stored within MacOS third party apps by abusing surrogate applications for code injection, including a case study of Microsoft Remote Desktop and Google Drive.
      • Bypassing MacOS Privacy Controls - Adam Chester(2020)
    • Talks/Presentations/Videos
    • Tools
  • Credentials from Web Browsers
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
    • Tools
  • Credentials in Files
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
    • Tools
  • Exploitation for Credential Access
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
    • Tools
  • Input Capture
    • Articles/Blogposts/Writeups
      • How to Dump 1Password, KeePassX & LastPass Passwords in Plaintext - Tokyoneon
    • Talks/Presentations/Videos
    • Tools
      • kcap
        • This program simply uses screen captures and programmatically generated key and mouse events to locally and graphically man-in-the-middle an OS X password prompt to escalate privileges.
  • Input Prompt
    • Articles/Blogposts/Writeups
      • osascript: for local phishing - fuzzynop
    • Talks/Presentations/Videos
    • Tools
      • Empire propmt.py
      • FiveOnceinYourlife
        • Local osx dialog box phishing using osascript. Easier than keylogging on osx. Simply ask for the passwords you want.
  • Keychain
    • Articles/Blogposts/Writeups
      • Keychain Services - developer.apple.com
      • Security Flaw in OS X displays all keychain passwords in plain text - Brenton Henry(2016)
        • There is a method in OS X that will allow any user to export your keychain, without sudo privileges or any system dialogs, to a text file, with the username and passwords displayed in plain text. As of this writing(2016), this method works in at least 10.10 and 10.11.5, and presumably at the least all iterations in between.
    • Talks/Presentations/Videos
      • OBTS v2.0 "KeySteal: A Vulnerability in Apple's Keychain" (Linus Henze)
        • Slides
        • What do your iCloud, Slack, MS Office, etc. credentials have in common? Correct, they're all stored inside your Mac's Keychain. While the Keychain is great because it prevents all those annoying password prompts from disturbing you, the ultimate question is: Is it really safe? Does it prevent malicious Apps from stealing all my passwords?In this talk I will try to answer those questions, showing you how the Keychain works and how it can be exploited by showing you the full details of my KeySteal exploit for the first time. The complete exploit code will be available online after the talk.
    • Tools
      • Mac OS X Keychain Forensic Tool
        • The chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner. Master Key candidates can be extracted from volafox or volatility keychaindump module. Supports: Snow Leopard, Lion, Mountain Lion, Mavericks, Yosemite, El Capitan, (High) Sierra. This branch contains a quick patch for chainbreaker to dump non-exportable keys on High Sierra, see README-keydump.txt for more details.
      • KeySteal
        • KeySteal is a macOS <= 10.14.3 Keychain exploit that allows you to access passwords inside the Keychain without a user prompt. The vulnerability has been assigned CVE-2019-8526 number.
      • OSX Key Chain Dumper
        • 'Scripts to dump the values out of OSX Keychain. Tested on OS X El Capitan ver 10.11.6'
      • keychaindump(2015)
        • Keychaindump is a proof-of-concept tool for reading OS X keychain passwords as root. It hunts for unlocked keychain master keys located in the memory space of the securityd process, and uses them to decrypt keychain files.
      • osx-hash-dumper
        • Bash script to dump OSX user hashes in crackable format. Author: Cedric Owens
      • retrieve-osxhash.py
  • Network Sniffing
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
    • Tools
  • Private Keys
    • Articles/Blogposts/Writeups
  • Securityd Memory
    • Articles/Blogposts/Writeups
    • Tools
  • Steal Web Session Cookie
    • Articles/Blogposts/Writeups
    • Tools
  • Two-Factor Authentication Interception
    • Articles/Blogposts/Writeups
    • Tools
• Discovery
  • forgetmenot
    • local looting script in python
  • APOLLO - Apple Pattern of Life Lazy Output'er
    • APOLLO stands for Apple Pattern of Life Lazy Output’er. I wanted to create this tool to be able to easily correlate multiple databases with hundreds of thousands of records into a timeline that would make the analyst (me, mostly) be able to tell what has happened on the device. iOS (and MacOS) have these absolutely fantastic databases that I’ve been using for years with my own personal collection of SQL queries to do what I need to get done. This is also a way for me to share my own research and queries with the community. Many of these queries have taken hours, even days to research and compile into something useful. My goal with this script is to put the analysis function the SQL query itself. Each query will output a different part of the puzzle. The script itself just compiles the data into a CSV or SQLite database for viewing and filtering. While this database/spreadsheet can get very large, it is still more efficient that running queries on multiple databases and compiling the data into a timeline manually.
  • Account Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Application Window Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Browser Bookmark Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • File and Directory Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Network Service Scanning
    • Articles/Blogposts/Writeups
    • Tools
  • Network Share Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Network Sniffing
    • Articles/Blogposts/Writeups
    • Tools
  • Password Policy Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Peripheral Device Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Permission Groups Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Process Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Remote System Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Security Software Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Software Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • System Information Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • System Network Configuration Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • System Network Connections Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • System Owner/User Discovery
    • Articles/Blogposts/Writeups
    • Tools
  • Virtualization/Sandbox Evasion
    • Articles/Blogposts/Writeups
    • Tools
• Lateral Movement
  • AppleScript
    • Articles/Blogposts/Writeups
    • Tools
  • Application Deployment Software
    • Articles/Blogposts/Writeups
    • Tools
  • Exploitation of Remote Services
    • Articles/Blogposts/Writeups
    • Tools
  • Internal Spearphishing
    • Articles/Blogposts/Writeups
    • Tools
  • Logon Scripts
    • Articles/Blogposts/Writeups
    • Tools
  • Remote File Copy
    • Articles/Blogposts/Writeups
    • Tools
  • Remote Services
    • Articles/Blogposts/Writeups
    • Tools
  • SSH Hijacking
    • Articles/Blogposts/Writeups
      • Interacting with MacOS terminal windows for lateral movement - Steve Borosh
    • Tools
  • Third-party Software
    • Articles/Blogposts/Writeups
    • Tools
• Collection
  • 101
  • Articles/Blogposts/Writeups
    • Breaking macOS Mojave Beta: does apple adequately protect the webcam and mic? ...no - Patrick Wardle(2018)
  • Tools
  • Audio Capture
  • Automated Collection
  • Clipboard Data
  • Data from Information Repositories
  • Data from Local System
    • PICT - Post-Infection Collection Toolkit
      • This set of scripts is designed to collect a variety of data from an endpoint thought to be infected, to facilitate the incident response process. This data should not be considered to be a full forensic data collection, but does capture a lot of useful forensic information.
    • PICT-Swift (Post Infection Collection Toolkit)
      • This is a Swift (and slightly modified) version of Thomas Reed's PICT (Post Infection Collection Toolkit: https://github.com/thomasareed/pict). Thomas Reed is the brains behind the awesome PICT concept. I just simply wrote a Swift version of it and added an additional collector.
    • macOS-browserhist-parser
      • Swift code to parse the quarantine history database, Chrome history database, Safari history database, and Firefox history database on macOS.
  • Data from Network Shared Drive
  • Data from Removable Media
  • Data Staged
  • Input Capture
  • Screen Capture
  • Video Capture
• MacOS Red Teaming Blogpost Series by Action Dan
  • MacOS Red Teaming 201: Introduction - Action Dan
  • MacOS Red Teaming 202: Profiles - Action Dan
  • MacOS Red Teaming 203: MDM (Mobile Device Managment - Action Dan)
  • MacOS Red Teaming 204: Munki Business - Action Dan
  • MacOS Red Teaming 205: TCC (Transparency, Consent, and Control - Action Dan)
  • MacOS Red Teaming 206: ARD (Apple Remote Desktop Protocol - Action Dan)
  • MacOS Red Teaming 207: Remote Apple Events (RAE) - Action Dan
  • MacOS Red Teaming 208: macOS ATT&CK Techniques - Action Dan
  • MacOS Red Teaming 209: macOS Frameworks for Command and Control - Action Dan
  • MacOS Red Teaming 210: Abusing Pkgs for Privilege Escalation - Action Dan
  • MacOS Red Teaming 211: Dylib Hijacking - Action Dan
• Technologies
  • macOS Code Signing In Depth

---

Post-Exploitation Windows

• 101

  • Windows CMD Reference - ms

• Living_off_The_Land

  • 101
    • Living Off The Land: A Minimalist's Guide To Windows Post Exploitation Christopher(Derbycon3)
    • LOLBins - Living Off The Land Binaries & Scripts & Libraries
      • "Living off the land" was coined by Matt Graeber - @mattifestation <3
      • The term LOLBins came from a twitter discussion on what to call these binaries. It was first proposed by Philip Goh - @MathCasualty here: https://twitter.com/MathCasualty/status/969174982579273728
      • The term LOLScripts came from Jimmy - @bohops: https://twitter.com/bohops/status/984828803120881665
      • Installers – Interactive Lolbins - Hexacorn
  • Articles/Blogposts/Writeups
    • Installers – Interactive Lolbins, Part 2 - Hexacorn
    • Bring your own lolbas? - Hexacorn
    • Reusigned Binaries - Hexacorn
    • Reusigned Binaries – Living off the signed land - Hexacorn
    • Hack Microsoft Using Microsoft Signed Binaries - Pierre-Alexandre Braeken
    • Microsoft Applications and Blocklist - FortyNorth Security
    • Unsanitized file validation leads to Malicious payload download via Office binaries. - Reegun J
    • Background Intelligent Transfer Protocol - TH Team
    • Stay positive Lolbins… not! - Hexacorn
    • Living Off the Land - liberty-shell
  • Talks/Presentations/Videos
    • Covert Attack Mystery Box: A few novel techniques for exploiting Microsoft "features" - Mike Felch and Beau Bullock (WWHF2018)
      • Over the last few months we’ve been doing a bit of research around various Microsoft “features”, and have mined a few interesting nuggets that you might find useful if you’re trying to be covert on your red team engagements. This talk will be “mystery surprise box” style as we’ll be weaponizing some things for the first time. There will be demos and new tools presented during the talk. So, if you want to win at hide-n-seek with the blue team, come get your covert attack mystery box!
  • In-the-Spirit-Of
    • BADministration
      • BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always: use for good, promote security, and fight application propagation.
  • Not really
    • Windows Store Apps Can Compromise PC Security - Russell Smith

• Execution

  • Articles/Blogposts/Writeups

    • cmd.exe running any file no matter what extension - Hexacorn
    • Post-Exploitation on Windows using ActiveX Controls
      • When exploiting software vulnerabilities it is sometimes impossible to build direct communication channels between a target machine and an attacker's machine due to restrictive outbound filters that may be in place on the target machine's network. Bypassing these filters involves creating a post-exploitation payload that is capable of masquerading as normal user traffic from within the context of a trusted process. One method of accomplishing this is to create a payload that enables ActiveX controls by modifying Internet Explorer's zone restrictions. With ActiveX controls enabled, the payload can then launch a hidden instance of Internet Explorer that is pointed at a URL with an embedded ActiveX control. The end result is the ability for an attacker to run custom code in the form of a DLL on a target machine by using a trusted process that uses one or more trusted communication protocols, such as HTTP or DNS.
    • Penetration Testing: Stopping an Unstoppable Windows Service - Scott Sutherland
    • SirepRAT
      • Remote Command Execution as SYSTEM on Windows IoT Core; The method is exploiting the Sirep Test Service that’s built in and running on the official images offered at Microsoft’s site. This service is the client part of the HLK setup one may build in order to perform driver/hardware tests on the IoT device. It serves the Sirep/WPCon/TShell protocol. We broke down the Sirep/WPCon protocol and demonstrated how this protocol exposes a remote command interface for attackers, that include RAT abilities such as get/put arbitrary files on arbitrary locations and obtain system information. Based on the findings we have extracted from this research about the service and protocol, we built a simple python tool that allows exploiting them using the different supported commands. We called it SirepRAT. It features an easy and intuitive user interface for sending commands to a Windows IoT Core target. It works on any cable-connected device running Windows IoT Core with an official Microsoft image.
      • Whitepaper
      • Slides

  • CMSTP

    • Articles/Blogposts/Writeups
    • Tools

  • Command-Line Interface

    • Articles/Blogposts/Writeups
      • DOSfuscation: Exploring the Depths of Cmd.exe Obfuscation and Detection Techniques - Daniel Bohannon
    • Tools
      • Invoke-DOSfuscation
        • Cmd.exe Command Obfuscation Generator & Detection Test Harness

  • Compiled HTML File

    • Articles/Blogposts/Writeups
    • Tools

  • Component Object Model and Distributed COM

    • Articles/Blogposts/Writeups
      • Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse - ired.team
    • Tools

  • Control Panel Items

    • Articles/Blogposts/Writeups
    • Tools

  • Dynamic Data Exchange

    • Articles/Blogposts/Writeups
      • DDE Downloaders, Excel Abuse, and a PowerShell Backdoor - rinseandREpeat analysis
    • Tools

  • Excel

    • Articles/Blogposts/Writeups
      • Welcome to the Excel Software Development Kit - docs.ms
      • DLL Execution via Excel.Application RegisterXLL() method - Ryan Hanson
      • ExcelDllLoader
      • Use Excel.Application object's RegisterXLL() method to load dll - 3gstudent
    • Tools
      • Hello World XLL
        • This is a simple XLL, showing how to create an XLL from scratch.
      • xllpoc
        • A small project that aggregates community knowledge for Excel XLL execution, via xlAutoOpen() or PROCESS_ATTACH.

  • Execution through API

    • Articles/Blogposts/Writeups
    • Tools

  • Execution through Module Load

    • Articles/Blogposts/Writeups
    • Tools

  • Exploitation for Client Execution

    • Articles/Blogposts/Writeups
      • CVE-2019-0726 - MWRLabs
        • DHCP client rce
    • Tools

  • Graphical User Interface

    • Articles/Blogposts/Writeups
    • Tools

  • InstallUtil

    • Articles/Blogposts/Writeups
    • Tools

  • LSASS Driver

    • Articles/Blogposts/Writeups
    • Tools

  • Mshta

    • Articles/Blogposts/Writeups
    • Tools

  • PowerShell

    • Articles/Blogposts/Writeups
    • Tools

  • Regsvcs/Regasm

    • Articles/Blogposts/Writeups
    • Tools

  • Regsvr32

    • Articles/Blogposts/Writeups
    • Tools

  • Rundll32

    • Articles/Blogposts/Writeups
    • Tools

  • Scheduled Task

    • Articles/Blogposts/Writeups
    • Tools

  • Scripting

    • Articles/Blogposts/Writeups
    • Tools

  • Service Execution

    • Articles/Blogposts/Writeups
    • Tools

  • Signed Binary Proxy Execution

    • Articles/Blogposts/Writeups
    • Tools

  • Signed Script Proxy Execution

    • Articles/Blogposts/Writeups
    • Tools

  • Third-party Software

    • Articles/Blogposts/Writeups
    • Tools

  • Trusted Developer Utilities

    • Articles/Blogposts/Writeups
      • MSBuild - docs.ms
      • MSBuild Inline Tasks - docs.ms
      • Understanding the Project File(MSBuild) - docs.ms
      • Doing More With MSBuild - 3gstudent
      • Aggressive MSBuild - Bypass Detection - fortynorthsecurity
    • Tools

  • User Execution

    • Articles/Blogposts/Writeups

      • ClickOnce Security and Deployment - docs.ms
      • ClickOnce (Twice or Thrice): A Technique for Social Engineering and (Un)trusted Command Execution - bohops

    • Tools

  • Windows Management Instrumentation

    • Articles/Blogposts/Writeups
    • Tools

  • Windows Remote Management

    • Articles/Blogposts/Writeups
    • Tools

  • XSL Script Processing

    • Articles/Blogposts/Writeups
    • Tools

• Persistence

  • Accessibility Features
  • Account Manipulation
  • AppCert DLLs
  • AppInit DLLs
  • Application Shimming
  • Authentication Package
  • BITS Jobs
  • Bootkit
  • Browser Extensions
  • Change Default File Association
  • Component Firmware
  • Component Object Model Hijacking
  • Create Account
  • DLL Search Order Hijacking
  • External Remote Services
  • File System Permissions Weakness
  • Hidden Files and Directories
  • Hooking
  • Hypervisor
  • Image File Execution Options Injection
  • Logon Scripts
  • LSASS Driver
  • Modify Existing Service
  • Netsh Helper DLL
  • New Service
  • Office Application Startup
  • Path Interception
  • Port Monitors
  • PowerShell Profile
  • Redundant Access
  • Registry Run Keys / Startup Folder
  • Scheduled Task
  • Screensaver
  • Security Support Provider
  • Server Software Component
  • Service Registry Permissions Weakness
  • Shortcut Modification
  • SIP and Trust Provider Hijacking
  • System Firmware
  • Time Providers
  • Valid Accounts
  • Web Shell
  • Windows Management Instrumentation Event Subscription
  • Winlogon Helper DLL
  • 101
    • Windows Userland Persistence Fundamentals - b33f
  • Articles/Blogposts/Writeups
    • Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence - bohops
    • Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence (Part 2) - bohops
    • Userland Persistence with Scheduled Tasks and COM Handler Hijacking - enigma0x3
    • Quiet in the Windows: Dropping Network Connections - Eviatar Gerzi
    • Pentester’s Windows NTFS Tricks Collection - Rene Freingruber
    • RID Hijacking: Maintaining access on Windows machines - r4wd3r
    • Hiding Registry keys with PSReflect - Brian Reitz
    • Evading Autoruns Kyle Hanslovan Chris Bisnett - DerbyCon 7
    • RE: Evading Autoruns PoCs on Windows 10 - Kyle Hanslovan
    • Hiding Files by Exploiting Spaces in Windows Paths
    • Stealing passwords every time they change - carnal0wnage
    • Activation Contexts — A Love Story - Philip Tsukerman
      • TL;DR — Windows loads a version of the Microsoft.Windows.SystemCompatible assembly manifest into every process. Tampering with it lets you inject DLL side-loading opportunities into every process, and to perform COM hijacking without touching the registry. Unfortunately, the manifest could be replaced by another version, possibly killing your persistence by surprise.
  • Talks/Presentations/Videos
    • Evading Autoruns - Kyle Hanslovan, Chris Bisnet(Derbycon2017)
      • When it comes to offense, maintaining access to your endpoints is key. For defenders, it's equally important to discover these footholds within your network. During this talk, Kyle and Chris will expose several semi-public and private techniques used to evade the most common persistence enumeration tools. Their techniques will explore ways to re-invent the run key, unconventionally abuse search order, and exploit trusted applications. To complement their technical explanations, each bypass will include a live demo and recommendations for detection.
    • Materials
    • Here to stay: Gaining persistency by Abusing Advanced Authentication Mechanisms - Marina Simakov, Igal Gofman
      • Slides
  • Tools
    • Invisible Persistence
      • Code
      • Paper
    • Evading Autoruns - DerbyCon 7.0
    • RID Hijacking: Maintaining Access on Windows Machines
      • The RID Hijacking hook, applicable to all Windows versions, allows setting desired privileges to an existent account in a stealthy manner by modifying some security attributes of an user. By only using OS resources, it is possible to replace the RID of an user right before the primary access token is created, allowing to spoof the privileges of the hijacked RID owner.
      • Presentation - Derbycon 8
      • Blogpost
    • DropNet
      • A tool that can be used to close network connections automatically with a given parameters
  • Active Directory
    • Sneaky Active Directory Persistence Tricks - adsecurity.org
    • Obtaining and Detecting Domain Persistence - Grant Bugher(DEF CON 23)
      • When a Windows domain is compromised, an attacker has several options to create backdoors, obscure his tracks, and make his access difficult to detect and remove. In this talk, I discuss ways that an attacker who has obtained domain administrator privileges can extend, persist, and maintain control, as well as how a forensic examiner or incident responder could detect these activities and root out an attacker.
    • Shadow Admins – The Stealthy Accounts That You Should Fear The Most - Asaf Hect
    • Thousand ways to backdoor a Windows domain (forest)
    • Remote Hash Extraction On Demand Via Host Security Descriptor Modification - Will Harmjoy
      • Tl;dr if you gain “administrative” access to a remote machine, you can modify a few host security descriptors and have a security principal/trustee of your choice generate Silver Tickets indefinitely, as well as remotely retrieve local hashes and domain cached credentials.
  • AppDomain
    • Use AppDomainManager to maintain persistence
  • AppInit.dlls
    • AppInit_DLLs in Windows 7 and Windows Server 2008 R2 - docs.ms
    • AppInit DLLs and Secure Boot - docs.ms
      • Starting in Windows 8, the AppInit_DLLs infrastructure is disabled when secure boot is enabled.
    • Alternative psexec: no wmi, services or mof needed - Diablohorn
      • Poc
  • Application Plugins
    • Backdooring Plugins - Averagejoe
  • APPX/UWP
    • Persistence using Universal Windows Platform apps (APPX) - oddvarmoe
      • Persistence can be achieved with Appx/UWP apps using the debugger options. This technique will not be visible by Autoruns.
  • Alternate Data Streams
    • Articles/Blogposts/Writeups
      • Putting data in Alternate data streams and how to execute it - oddvar.moe
        • Part 2
      • Kurt Seifried Security Advisory 003 (KSSA-003)
      • NTFS Alternate Data Streams for pentesters (part 1)
      • Using Alternate Data Streams to Persist on a Compromised Machine
      • Using Alternate Data Streams to Persist on a Compromised Machine - enigma0x3
      • NTFS Alternate Data Streams - darknessgate.com
    • Talks & Presentations
    • Tools
      • Exe_ADS_Methods.txt - api0cradle
        • Execute from Alternate Streams
      • Get-ADS
        • Powershell script to search for alternate data streams
      • Evading Autoruns
        • When it comes to offense, maintaining access to your endpoints is key. For defenders, it's equally important to discover these footholds within your network. During this talk, Kyle and Chris will expose several semi-public and private techniques used to evade the most common persistence enumeration tools. Their techniques will explore ways to re-invent the run key, unconventionally abuse search order, and exploit trusted applications. To complement their technical explanations, each bypass will include a live demo and recommendations for detection.
        • Talk
      • Alternate-Data-Streams with PowerShell
        • I literally stumbled upon this whilst reading up on the parameters for the Get-Content and Set-Content cmdlets for another piece of research. The parameter that got my interest is -Stream which allows the user the ability to read and write NTFS alternate data streams. If we create a file with the following commands: $file = "$env:TEMP\test.txt" \ Set-Content -Path $file -Value 'Alternate Data Stream Test File'. To read the file content, we use the following: Get-Content -Path $file ; Which will return: Alternate Data Stream Test File
      • Get-ADS
        • Powershell script to search for alternate data streams This script searches recursively through a specified file system for alternate data streams (ADS). The script can search local and UNC paths speciffied by the $path paramenter. All readable files will have the stream attrubute inspected ignoring the default DATA and FAVICON (image file on URL files) streams. The script use Boe Prox's amazing Get-RunspaceData function and other code to multithread the search. The default number of threads is the number of logical cores plus one. This can be adjusted by specifiying the $threads parameter. Use with caution as runspaces can easily chomp resources (CPU and RAM). Once the number of file system objects (files and folders) is determined, they are split into equal groups of objects divided by the number of threads. Then each thread has a subset of the total objects to inspect for ADS.
  • bitsadmin
    • Temporal Persistence with bitsadmin and schtasks /userland-persistence-with-scheduled-tasks-and-com-handler-hijacking/)
  • COM
    • COM Object hijacking: the discreet way of persistence
    • Userland Persistence with Scheduled Tasks and COM Handler Hijacking
    • How To Hunt: Detecting Persistence & Evasion With The COM - Blake Strom
    • Persistence: “the continued or prolonged existence of something”: Part 2 – COM Hijacking - MDSec
    • Use COM Object hijacking to maintain persistence——Hijack CAccPropServicesClass and MMDeviceEnumerator - 3gstudent
    • Use COM Object hijacking to maintain persistence——Hijack explorer.exe - 3gstudent
    • Activation Contexts — A Love Story - Philip Tsukerman(2019)
      • TL;DR — Windows loads a version of the Microsoft.Windows.SystemCompatible assembly manifest into every process. Tampering with it lets you inject DLL side-loading opportunities into every process, and to perform COM hijacking without touching the registry. Unfortunately, the manifest could be replaced by another version, possibly killing your persistence by surprise.
  • Directory Services Restore Mode
    • Sneaky Active Directory Persistence #11: Directory Service Restore Mode (DSRM)
    • Sneaky Active Directory Persistence #13: DSRM Persistence v2
  • Drivers
    • Windows Firewall Hook Enumeration
      • We’re going to look in detail at Microsoft Windows Firewall Hook drivers from Windows 2000, XP and 2003. This functionality was leveraged by the Derusbi family of malicious code to implement port-knocking like functionality. We’re going to discuss the problem we faced, the required reverse engineering to understand how these hooks could be identified and finally how the enumeration tool was developed.
  • Event Log
    • Windows Event Log Driven Back Doors
  • File Handling/Execution
    • Persistence using GLOBALFLAGS in image file execution options – hidden from autoruns.exe - Oddvar Moe
    • Registering an Application to a URI Scheme - docs.ms
  • LAPS
    • Mise en place d'une Backdoor LAPS via modification de l'attribut SearchFlags avec DCShadow - Gregory Lucand
    • Adding a Backdoor to AD in 400 Milliseconds - David Rowe
    • LAPS - 3gstudent
    • LAPS - liuhaihua
  • Library Files
    • Abusing Windows Library Files for Persistence - F-Secure
  • Golden(Silver) Ticket
    • Golden Ticket
    • Kerberos Golden Tickets are Now More Golden
    • Silver & Golden Tickets - hackndo
    • Mimikatz 2.0 - Golden Ticket Walkthrough - Ben Lincoln
  • IIS
    • IIS Raid – Backdooring IIS Using Native Modules - MDSec
  • msdtc
    • Use msdtc to maintain persistence - 3gstudent
  • MS Office
    • Persistence: “the continued or prolonged existence of something” - Dominic Chell
    • Add-In Opportunities for Office Persistence - William Knowles
    • One Template To Rule 'Em All - Kostas Lintovois
      • Introduction of wePWNize
    • Persisting with Microsoft Office: Abusing Extensibility Options - William Knowles
    • Use Office to maintain persistence - 3gstudent
    • Office Persistence on x64 operating system - 3gstudent
  • .NET
    • Common Language Runtime Hook for Persistence - Paul Laine
      • This blog post explains how it is possible to execute arbitrary code and maintain access to a Microsoft Windows system by leveraging the Common Language Runtime application domain manager.
    • CLR-Persistence
      • Use CLR to inject all the .NET apps
    • Using CLR to maintain Persistence
    • Common Language Runtime Hook for Persistence - Paul Laine
    • SharPersist: Windows Persistence Toolkit in C# - Brett Hawkins
    • SharPersist
      • Windows persistence toolkit written in C#
  • Netsh Helper DLL
    • Persistence – Netsh Helper DLL - NetbiosX
  • Password Filter DLL
    • 101
      • Password Filters - docs.ms
        • Password filters provide a way for you to implement password policy and change notification.
      • AD Password Filters - ldapwiki
      • Installing and Registering a Password Filter DLL - docs.ms
        • You can use the Windows password filter to filter domain or local account passwords. To use the password filter for domain accounts, install and register the DLL on each domain controller in the domain.
      • Installing and Registering a Password Filter DLL - msdn.ms
      • PSAM_PASSWORD_NOTIFICATION_ROUTINE callback function - docs.ms
        • The PasswordChangeNotify function is implemented by a password filter DLL. It notifies the DLL that a password was changed.
    • Articles/Blogposts/Writeups
      • Capture password change at active directory controller - StackOverflow(2013)
      • How a Windows Password Filters Works - NFront(2014)
      • Stealing passwords every time they change - carnal0wnage(2013)
      • Intercepting Password Changes With Function Hooking - clymb3r(2013)
      • T1174: Password Filter - @spottheplanet
      • Throwing it out the Windows: Exfiltrating Active Directory credentials through DNS - Leanne Dutil
        • This post will detail the password filter implant project we developed recently. Our password filter is used to exfiltrate Active Directory credentials through DNS. This text will discuss the technicalities of the project as well as my personal experience developing it.
      • Dump-Clear-Text-Password-after-KB2871997-installed - 3gstudent
      • Domain Penetration-Hook PasswordChangeNotify – Three Good Students
    • Talks/Presentations/Videos
    • Tools
      • DLLPasswordFilterImplant
        • DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in the Active Directory (AD).
      • OpenPasswordFilter
        • OpenPasswordFilter is an open source custom password filter DLL and userspace service to better protect / control Active Directory domain passwords.
      • PasswordStealing
        • Password stealing DLL I have written about 1999, some time before Active Directory was announced. And of course it still works. First, it was written in 32-bit Delphi (pardon my language) and when it stopped working as everything changed into 64-bit - in (so much simpler when it comes to Win32 API) C, as I did not have 64-bit Delphi. The original implementation was a bit more complex, including broadcasting the changed password over the network etc. but now it works as a demonstration of an idea, so let's keep it as simple as possible. It works everywhere - on local machines for local accounts and on DCs for domain accounts.
  • PowerShell
    • Using and Abusing Aliases with PowerShell - notoriousrebel.space
      • Shimming Aliases with PowerShell
    • Remapper
      • PowerShell script that will shim aliases throughout PowerShell sessions through the use of PowerShell profiles.
    • p0shkiller(2016)
      • Proof of Concept exploit to bypass Microsoft latest AntiMalware Scan Interface technology within PowerShell5 on Windows 10. With this exploit/patch applied, you can take control over powershells program flow by using DLL Hijacking and UAC Bypasstechniques. Every time powershell is started, a local admin named BadAss with password FacePalm01 will be added to the system (when run by an non elevated administrator account) and a reverse (SYSTEM) https meterpreter session (default 192.168.1.120) will be started every hour using a scheduled task.
  • Protocol Handlers
    • Exploiting custom protocol handlers in Windows - Andrey Polkovnychenko
      • In this article we would like to present the mechanism for custom protocol handling in Windows, and how it can be exploited using a simple command injection vulnerability.
  • Registry
    • Windows Registry Attacks: Knowledge Is the Best Defense
    • Windows Registry Persistence, Part 1: Introduction, Attack Phases and Windows Services
    • Windows Registry Persistence, Part 2: The Run Keys and Search-Order
    • List of autorun keys / malware persistence Windows registry entries
    • How to Evade Detection: Hiding in the Registry - David Lu
    • Persistence – Registry Run Keys - NetbiosX
    • InvisiblePersistence
      • Persisting in the Windows registry "invisibly". Whitepaper and POC
  • SC/Scheduled Tasks
    • Sc
      • Communicates with the Service Controller and installed services. The SC.exe program provides capabilities similar to those provided in Services in the Control Panel.
    • schtasks
    • Script Task
      • Persistence Via MSSQL
  • Security Support Provider
    • Sneaky Active Directory Persistence #12: Malicious Security Support Provider (SSP)
  • SeEnableDelegationPrivilege
    • The Most Dangerous User Right You (Probably) Have Never Heard Of
    • SeEnableDelegationPrivilege Active Directory Backdoor
  • ScreenSaver
    • Persistence – Screensaver - NetbiosX
  • Services
    • Stealthier persistence using new services purposely vulnerable to path interception - Christophe Tafani-Dereeper
    • Persistence – New Service - NetbiosX
  • Shims
    • Post Exploitation Persistence With Application Shims (Intro)
    • Shimming for Post Exploitation(blog)
    • Demystifying Shims – or – Using the App Compat Toolkit to make your old stuff work with your new stuff
    • Post Exploitation Persistence With Application Shims (Intro)
    • Shim Database Talks
    • Using Application Compatibility Shims
    • Persistence via Shims - liberty-shell
  • Shortcuts
    • Persistence – Shortcut Modification - NetbiosX
  • SID History
    • Sneaky Active Directory Persistence #14: SID History
  • SQL Server
    • Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures - NETSPI
    • Script Task - doc.ms
  • Startup
    • Windows Startup Application Database
    • SYSTEM Context Persistence in GPO Startup Scripts
  • WaitFor
    • Persistence – WaitFor - NetbiosX
  • Windows Instrumentation Management
    • WMIC - Take Command-line Control over WMI - docs.ms
    • WMIC - docs.ms
    • Abusing Windows Management Instrumentation (WMI) to Build a Persistent, Asyncronous, and Fileless Backdoor
    • Abusing Windows Management Instrumentation (WMI) - Matthew Graeber(BH USA 2015)
      • Imagine a technology that is built into every Windows operating system going back to Windows 95, runs as System, executes arbitrary code, persists across reboots, and does not drop a single file to disk. Such a thing does exist and it's called Windows Management Instrumentation (WMI). With increased scrutiny from anti-virus and 'next-gen' host endpoints, advanced red teams and attackers already know that the introduction of binaries into a high-security environment is subject to increased scrutiny. WMI enables an attacker practicing a minimalist methodology to blend into their target environment without dropping a single utility to disk. WMI is also unlike other persistence techniques in that rather than executing a payload at a predetermined time, WMI conditionally executes code asynchronously in response to operating system events. This talk will introduce WMI and demonstrate its offensive uses. We will cover what WMI is, how attackers are currently using it in the wild, how to build a full-featured backdoor, and how to detect and prevent these attacks from occurring.
  • WPAD
    • WPAD Persistence
  • Miscellaneous
    • backdoorme
      • Tools like metasploit are great for exploiting computers, but what happens after you've gained access to a computer? Backdoorme answers that question by unleashing a slew of backdoors to establish persistence over long periods of time. Once an SSH connection has been established with the target, Backdoorme's strengths can come to fruition. Unfortunately, Backdoorme is not a tool to gain root access - only keep that access once it has been gained.
    • Windows Program Automatic Startup Locations(2004) BleepingComputer

• Privilege Escalation

  • 101

    • Windows Privilege Escalation Fundamentals
    • Windows Privilege Escalation Methods for Pentesters
    • Common Windows Privilege Escalation Vectors
    • Windows Privilege Escalation Cheat Sheet/Tricks
    • Windows / Linux Local Privilege Escalation Workshop
    • Hunting for Privilege Escalation in Windows Environment - Heirhabarov
    • Elevating your Windows Privileges Like a Boss! - Jake Williams(WWHF2019)
      • Local privilege escalation on Windows is becoming increasingly difficult. Gone are the days when you could just easily exploit the Windows kernel. Multiple controls (KASLR, DEP, SMEP, etc.) have made kernel mode exploitation of the bugs that are discovered much more difficult. In this talk, we'll discuss multiple opportunities for privilege escalation including using COM objects, DLL side loading, and various privileges assigned to user accounts. Bring a Windows 10 VM. We'll have instructions available for recreating the scenarios demonstrated in the talk.

  • General

    • Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege - James Forshaw
    • Windows Exploitation Tricks: Arbitrary Directory Creation to Arbitrary File Read - James Forshaw
    • PrivescCheck
      • This script aims to enumerate common Windows security misconfigurations which can be leveraged for privilege escalation and gather various information which might be useful for exploitation and/or post-exploitation.

  • Specific Techniques

    • Always Install Elevated
      • AlwaysInstallElevated - docs.ms
      • Always Install Elevated - NetbiosX
      • Get-RegistryAlwaysInstallElevated - PowerSploit
    • DLL Stuff
      • Creating a Windows DLL with Visual Basic
      • Calling DLL Functions from Visual Basic Applications - msdn
      • DLL Hijacking
        • Dynamic-Link Library Search Order - docs.ms
        • Dynamic-Link Library Hijacking
        • Crash Course in DLL Hijacking
        • VB.NET Tutorial - Create a DLL / Class Library
        • Windows 10 - Task Scheduler service - Privilege Escalation/Persistence through DLL planting - remoteawesomethoughts.blogspot
        • DLL Hijacking via URL files - InsertScript
      • DLL Injection
        • DLL Injection and Hooking
        • Windows DLL Injection Basics
        • Crash Course in DLL Hijacking
        • Windows DLL Injection Basics - OpenSecurityTraining
        • An Improved Reflective DLL Injection Technique - Dan Staples
        • Reflective DLL Injection with PowerShell - clymb3r
        • Delivering custom payloads with Metasploit using DLL injection - blog.cobalstrike
        • Understanding how DLL Hijacking works - Astr0baby
        • DLL Injection - NetbiosX
      • DLL Tools
        • rattler
          • Rattler is a tool that automates the identification of DLL's which can be used for DLL preloading attacks.
        • injectAllTheThings
          • Single Visual Studio project implementing multiple DLL injection techniques (actually 7 different techniques) that work both for 32 and 64 bits. Each technique has its own source code file to make it easy way to read and understand.
        • Pazuzu
          • Pazuzu is a Python script that allows you to embed a binary within a precompiled DLL which uses reflective DLL injection. The goal is that you can run your own binary directly from memory. This can be useful in various scenarios.
        • Bleak
          • A Windows native DLL injection library written in C# that supports several methods of injection.
        • [Reflective DLL injection using SetThreadContext() and NtContinue(https://zerosum0x0.blogspot.com/2017/07/threadcontinue-reflective-injection.html)
          • Code
    • Exploits/Missing Patches
      • Windows Kernel Exploits - NetbiosX
      • kernel-exploits - SecWiki
      • MS17-010 (Eternal Blue)
      • CVE-2018-8140
        • Want to Break Into a Locked Windows 10 Device? Ask Cortana (CVE-2018-8140) - Cedric Cochin, Steve Povolny
      • CVE-2019-0841
        • AppX Deployment Service Local Privilege Escalation - CVE-2019-0841 BYPASS #2 - sandboxescaper
      • CVE-2019-1064
        • CVE-2019-1064 AppXSVC Local Privilege Escalation - RhythmStick
      • CVE-2019-1069
        • Exploiting the Windows Task Scheduler Through CVE-2019-1069 - Simon Zuckerbraun
      • CVE-2019–1082
        • More Than a Penetration Test (Microsoft Windows CVE-2019–1082) - Michal Bazyli
      • CVE-2020-0618
        • CVE-2020-0618: RCE in SQL Server Reporting Services (SSRS) - MDSec
      • CVE-2020-0787
        • BitsArbitraryFileMove
      • CVE-2020-0796
        • CVE-2020-0796
          • Windows SMBv3 LPE Exploit
      • Miscellaneous
        • CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service - Phillip Langlois and Edward Torkington
          • This blog post discusses two vulnerabilities discovered by NCC Group consultants during research undertaken on privilege elevation via COM local services. The first of these vulnerabilities (CVE-2019-1405) is a logic error in a COM service and allows local unprivileged users to execute arbitrary commands as a LOCAL SERVICE user. The second vulnerability (CVE-2019-1322) is a simple service misconfiguration that allows any user in the local SERVICE group to reconfigure a service that executes as SYSTEM (this vulnerability was independently also discovered by other researchers). When combined, these vulnerabilities allow an unprivileged local user to execute arbitrary commands as the SYSTEM user on a default installation of Windows 10.
        • Thanksgiving Treat: Easy-As-Pie Windows 7 Secure Desktop Escalation Of Privilege - Simon Zuckerbraun
    • Group Policy (Preferences)
      • Get-GPPermission - docs.ms
      • Exploiting Windows 2008 Group Policy Preferences
      • Decrypting Windows 2008 GPP user passwords using Gpprefdecrypt.py
      • Group Policy Preferences and Getting Your Domain 0wned - Carnal0wnage
      • Compromise Networks Through Group Policy Preferences - securestate.com(archive.org)
      • Group Policy Preferences - NetbiosX
    • Intel SYSRET
      • Windows Kernel Intel x64 SYSRET Vulnerability + Code Signing Bypass Bonus
      • Windows Kernel Intel x64 SYSRET Vulnerability Exploit + Kernel Code Signing Bypass Bonus
    • LAPS Misconfiguration
      • Taking over Windows Workstations thanks to LAPS and PXE - Rémi ESCOURROU
        • In this article we will examine how the combination of two good security solutions with no apparent connection to each other can lead to the takeover of all workstations in a Windows environment. The main advantage of this technique is that it is exploitable in black box, i.e. without any prior knowledge of the target.
      • Who Can See LAPS Passwords? - David Rowe
    • Local Phishing
      • Ask and ye shall receive - Impersonating everyday applications for profit - FoxIT
      • Phishing for Credentials: If you want it, just ask! - enigma0x3
      • Invoke-CredentialPhisher
        • The first one is a powershell script to send toast notifications on behalf on an (installed) application or the computer itself. The user will be asked to supply credentials once they click on the notification toast. The second one is a Cobalt Strike module to launch the phishing attack on connected beacons.
      • Phishing Windows Credentials - NetbiosX
    • Logic
      • Introduction to Logical Privilege Escalation on Windows - James Forshaw
      • Windows Logical EoP Workbook
      • Abusing Token Privileges For EoP
        • This repository contains all code and a Phrack-style paper on research into abusing token privileges for escalation of privilege. Please feel free to ping us with questions, ideas, insults, or bugs.
    • Named Pipes
      • Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit - Blake Watts(2002)
      • Named Pipe Filename Local Privilege Escalation - Securiteam(2003)
      • Windows Named Pipes & Impersonation - decoder.cloud(2019)
      • Windows NamedPipes 101 + Privilege Escalation - @spottheplanet
      • Part I: The Fundamentals of Windows Named Pipes - Robert Hawes
      • Part II: Analysis of a Vulnerable Microsoft Windows Named Pipe Application - Robert Hawes
    • Privileged File Operation Abuse
      • An introduction to privileged file operation abuse on Windows - @Claviollotte
        • TL;DR This is a (bit long) introduction on how to abuse file operations performed by privileged processes on Windows for local privilege escalation (user to admin/system), and a presentation of available techniques, tools and procedures to exploit these types of bugs.
    • NTLM-related
      • Search "NTLM" in the 'Network_Attacks.md' page.
      • Articles/Blogposts/Writeups
        • Practical Usage of NTLM Hashes - ropnop
        • Abusing Unsafe Defaults in Active Directory Domain Services: A Real-World Case Study - Louis Dion-Marcil
      • NTLM Reflection
        • Windows: DCOM DCE/RPC Local NTLM Reflection Elevation of Privilege
        • Windows: Local WebDAV NTLM Reflection Elevation of Privilege
        • Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin - Dirk-jan Mollema
          • Earlier this week, Microsoft issued patches for CVE-2019-1040, which is a vulnerability that allows for bypassing of NTLM relay mitigations. The vulnerability was discovered by Marina Simakov and Yaron Zinar (as well as several others credited in the Microsoft advisory), and they published a technical write-up about the vulnerability here. The short version is that this vulnerability allows for bypassing of the Message Integrity Code in NTLM authentication. The impact of this however, is quite big if combined with the Printer Bug discovered by Lee Christensen and some of my own research that builds forth on the Kerberos research of Elad Shamir. Using a combination of these vulnerabilities, it is possible to relay SMB authentication to LDAP. This allows for Remote code execution as SYSTEM on any unpatched Windows server or workstation (even those that are in different Active Directory forests), and for instant escalation to Domain Admin via any unpatched Exchange server (unless Exchange permissions were reduced in the domain). The most important takeaway of this post is that you should apply the June 2019 patches as soon as possible.
          • CVE-2019-1040 scanner
            • Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target host(s) and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx. Note that this does not generate failed login attempts as the login information itself is valid, it is just the NTLM message integrity code that is absent, which is why the authentication is refused without increasing the badpwdcount.
      • NTLM Relay
        • NTLM Relay - Pixis
        • Playing with Relayed Credentials - @agsolino
        • Server Message Block: SMB Relay Attack (Attack That Always Works) - CQURE Academy
        • Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes) - byt3bl33d3r
        • An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit - Jordan Drysdale
        • Effective NTLM / SMB Relaying - mubix
        • SMB Relay with Snarf - Jeff Dimmock
        • Responder with NTLM relay and Empire - chryzsh
      • Hot Potato
        • Hot Potato
          • Hot Potato (aka: Potato) takes advantage of known issues in Windows to gain local privilege escalation in default configurations, namely NTLM relay (specifically HTTP->SMB relay) and NBNS spoofing.
        • Hot Potato
        • SmashedPotato
      • Ghost Potato
        • Ghost Potato - shenaniganslabs.io(2019)
          • Halloween has come and gone, and yet NTLM reflection is back from the dead to haunt MSRC once again. This post describes a deceptively simple bug that has existed in Windows for 15 years. NTLM reflection is still possible through a highly reliable timing attack. The attack works by abusing the logic responsible for its mitigation, a widely speculated challenge cache. Attackers can purge this cache by deliberately failing an authentication attempt and doing so removes all challenge entries older than 5 minutes.
      • Tools
        • Snarf
          • Snarf man-in-the-middle / relay suite
        • eternalrelayx.py — Non-Admin NTLM Relaying & ETERNALBLUE Exploitation - Kory Findley
          • In this post, we will cover how to perform the EternalRelay attack, an attack technique which reuses non-Admin SMB connections during an NTLM Relay attack to launch ETERNALBLUE against hosts running affected versions of the Windows operating system. This attack provides an attacker with the potential to achieve remote code execution in the privilege context of SYSTEM against vulnerable Windows hosts without the need for local Administrator privileges or credentials.
        • Responder
          • Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
    • Registry Paths/Permissions
      • Insecure Registry Permissions - NetbiosX
      • RegSLScan
        • A tool for scanning registery key permissions. Find where non-admins can create symbolic links.
    • Services
      • The power of backup operators - decoder.cloud
        • Associated Code
      • Unquoted Service Path - NetbiosX
    • Stored Creds/Passwords on disk
      • Stored Credentials - NetbiosX
    • Tokens
      • Articles/Blogposts/Writeups
        • Abusing Token Privileges For LPE - drone/breenmachine
        • Post-Exploitation with “Incognito”. - Ignacio Sorribas
        • The Art of Becoming TrustedInstaller
          • There's many ways of getting the TI token other than these 3 techniques. For example as Vincent Yiu pointed out on Twitter if you've got easy access to a system token, say using Metasploit's getsystem command you can impersonate system and then open the TI token, it's just IMO less easy :-). If you get a system token with SeTcbPrivilege you can also call LogonUserExExW or LsaLogonUser where you can specify an set of additional groups to apply to a service token. Finally if you get a system token with SeCreateTokenPrivilege (say from LSASS.exe if it's not running PPL) you can craft an arbitrary token using the NtCreateToken system call.
        • c:\whoami /priv - [show me your privileges and I will lead you to SYSTEM] - Andrea Pierini
        • Windows: DCOM DCE/RPC Local NTLM Reflection Elevation of Privilege
        • Account Hunting for Invoke-TokenManipulation - TrustedSec
        • Tokenvator: A Tool to Elevate Privilege using Windows Tokens - Alexander Polce Leary
        • Tokenvator: Release 2 - Alexander Leary
        • Abusing SeLoadDriverPrivilege for privilege escalation - TarLogic
        • The power of backup operators - decoder.cloud
        • Token Manipulation
      • Talks & Presentations
        • Social Engineering The Windows Kernel: Finding And Exploiting Token Handling Vulnerabilities - James Forshaw - BHUSA2015
          • Slides
          • One successful technique in social engineering is pretending to be someone or something you're not and hoping the security guard who's forgotten their reading glasses doesn't look too closely at your fake ID. Of course there's no hyperopic guard in the Windows OS, but we do have an ID card, the Access Token which proves our identity to the system and let's us access secured resources. The Windows kernel provides simple capabilities to identify fake Access Tokens, but sometimes the kernel or other kernel-mode drivers are too busy to use them correctly. If a fake token isn't spotted during a privileged operation local elevation of privilege or information disclosure vulnerabilities can be the result. This could allow an attacker to break out of an application sandbox, elevate to administrator privileges, or even compromise the kernel itself. This presentation is about finding and then exploiting the incorrect handling of tokens in the Windows kernel as well as first and third party drivers. Examples of serious vulnerabilities, such as CVE-2015-0002 and CVE-2015-0062 will be presented. It will provide clear exploitable patterns so that you can do your own security reviews for these issues. Finally, I'll discuss some of the ways of exploiting these types of vulnerabilities to elevate local privileges.
      • Tools
        • Tokenvator
          • A tool to alter privilege with Windows Tokens
        • token_manipulation
          • Bypass User Account Control by manipulating tokens (can bypass AlwaysNotify)
      • Potatoes
        • Rotten Potato – Privilege Escalation from Service Accounts to SYSTEM - @breenmachine
        • Rotten Potato Privilege Escalation from Service Accounts to SYSTEM - Stephen Breen Chris Mallz - Derbycon6
        • RottenPotatoNG
          • New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.
        • The lonely potato - decoder.cloud(2017)
        • No more rotten/juicy potato? - decoder.cloud(2018)
          • Rotten potato inadvertently patched on Win10 1809
        • Potatoes and tokens - decoder.cloud(2018)
        • Juicy Potato (abusing the golden privileges) - Andrea Pierini, Giuseppe Trotta(2018)
          • Github)
    • PentestLab Windows PrivEsc Writeup List
      • Secondary Logon Handle
      • Insecure Registry Permissions
      • Intel SYSRET
      • Weak Service Permissions Obtaining System Privileges
      • The “SYSTEM” challenge
      • Writeup of achieving system from limited user privs.
      • All roads lead to SYSTEM
      • Alternative methods of becoming SYSTEM - XPN
      • admin to SYSTEM win7 with remote.exe - carnal0wnage
      • Getting a CMD prompt as SYSTEM in Windows Vista and Windows Server 2008 - blogs.technet
      • Another way to get to a system shell – Assistive Technology -oddvar.moe
        • Manipulate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\magnifier – StartExe to run other binary when pressing WinKey and plus to zoom.
        • Can load binary from Webdav and also start webbrowser and browse to desired link
        • Runs command as system during UAC prompt and logon screen

  • Talks/Videos

    • Hacking windows through the Windows API; delves into windows api, how it can break itself
    • Sedating the Watchdog Abusing Security Products to Bypass Windows Protections - Tomer Bit - BSidesSF
    • Black hat talk on Windows Privilege Escalation
    • Level Up! - Practical Windows Privilege Escalation
    • Extreme Privelege Escalataion on Windows8 UEFI Systems
      • Slides
      • Summary by stormehh from reddit: “In this whitepaper (and accompanying Defcon/Blackhat presentations), the authors demonstrate vulnerabilities in the UEFI "Runtime Service" interface accessible by a privileged userland process on Windows 8. This paper steps through the exploitation process in great detail and demonstrates the ability to obtain code execution in SMM and maintain persistence by means of overwriting SPI flash”
    • The Travelling Pentester: Diaries of the Shortest Path to Compromise
    • Windows Privilege Escalation - Riyaz Walikar
    • Privilege Escalation FTW - MalwareJake(WWHF2018)
      • Often you don't land in a penetration test with full admin rights. How can you fix that? In most networks it's easier than you might think. In this session, Jake will discuss and demonstrate various privilege escalation techniques that are possible primarily due to misconfigurations. Practically every network has one or more misconfigurations that let you easily escalate from random Joe to total pro. We'll examine some common issues present in both Windows and Linux to you can level up for your next penetration test.
    • Abusing privileged file operations on Windows - Clement Lavoillotte(Troopers19)

  • Tools

    • Windows Exploit Suggester
      • [Blogpost]https://blog.gdssecurity.com/labs/2014/7/11/introducing-windows-exploit-suggester.html
      • This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.
    • PowerUp
      • Windows Privilege Escalation through Powershell
    • ElevateKit
      • The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.
    • BeRoot
      • BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege.
    • Pompem
      • Pompem is an open source tool, designed to automate the search for Exploits and Vulnerability in the most important databases. Developed in Python, has a system of advanced search, that help the work of pentesters and ethical hackers. In the current version, it performs searches in PacketStorm security, CXSecurity, ZeroDay, Vulners, National Vulnerability Database, WPScan Vulnerability Database
    • AccessChk
      • As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output.
    • AutoDane at BSides Cape Town
    • Auto DANE
      • Auto DANE attempts to automate the process of exploiting, pivoting and escalating privileges on windows domains.
    • lonelypotato
      • Modified version of RottenPotatoNG C++
      • Blogpost
    • psgetsystem
      • getsystem via parent process using ps1 & embeded c#
    • Sherlock
      • PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
    • Robber
      • Robber is open source tool for finding executables prone to DLL hijacking
    • WinPrivCheck.bat
    • JAWS - Just Another Windows (Enum) Script
      • JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential privilege escalation vectors on Windows systems. It is written using PowerShell 2.0 so 'should' run on every Windows version since Windows 7.
    • Windows Exploit Suggester - Next Generation (WES-NG)
      • WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 10, including their Windows Server counterparts, is supported.
    • Powerless
      • "A Windows privilege escalation (enumeration) script designed with OSCP labs (i.e. legacy Windows machines without Powershell) in mind. The script represents a conglomeration of various privilege escalation checks, gathered from various sources, all done via native Windows binaries present in almost every version of Windows." - It's a batch file

  • Writeups

    • To-be-sorted
      • Analyzing local privilege escalations in win32k
        • This paper analyzes three vulnerabilities that were found in win32k.sys that allow kernel-mode code execution. The win32k.sys driver is a major component of the GUI subsystem in the Windows operating system. These vulnerabilities have been reported by the author and patched in MS08-025. The first vulnerability is a kernel pool overflow with an old communication mechanism called the Dynamic Data Exchange (DDE) protocol. The second vulnerability involves improper use of the ProbeForWrite function within string management functions. The third vulnerability concerns how win32k handles system menu functions. Their discovery and exploitation are covered.
      • Windows-Privilege-Escalation - frizb
        • Windows Privilege Escalation Techniques and Scripts
      • Some forum posts on Win Priv Esc
      • Post Exploitation Using netNTLM Downgrade attacks - Fishnet/Archive.org
      • Old Privilege Escalation Techniques
      • Windows 7 ‘Startup Repair’ Authentication Bypass
      • Windows Privilege Escalation Guide - sploitspren(2018)
        • Nice methodology/walk through of Windows PrivEsc methods and tactics
      • Windows Privilege Escalation Methods for Pentesters - pentest.blog
      • Linux Vulnerabilities Windows Exploits: Escalating Privileges with WSL - BlueHat IL 2018 - Saar Amar
        • Slides
      • CVE-2018-0952: Privilege Escalation Vulnerability in Windows Standard Collector Service - Ryan Hanson
      • Windows 10 Privilege Escalation using Fodhelper - hackercool
      • Local privilege escalation via the Windows I/O Manager: a variant finding collaboration - swiat
      • Abusing SeLoadDriverPrivilege for privilege escalation - Oscar Mallo
      • Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege - James Forshaw
      • Give Me Back My Privileges! Please? - itm4n
        • I want to tell you the story of a service account which lost all its powers (a.k.a. privileges). Windows world is getting increasingly ruthless and when the system considers you are not worthy, this is what happens. Fortunately for our service account, all is not lost, there’s still hope. In this merciless world, you can always turn to the old sages to find some comfort and support. Among them, the Task Scheduler might be willing to help and restore what was lost, provided that you ask kindly…
      • CVE-2020-0668 - A Trivial Privilege Escalation Bug in Windows Service Tracing - itm4n
        • "In this post, I’ll discuss an arbitrary file move vulnerability I found in Windows Service Tracing. From my testing, it affected all versions of Windows from Vista to 10 but it’s probably even older because this feature was already present in XP."
      • Issue 1554: Windows: Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix EoP - Project0
      • Waves Maxx Audio DLL Side-Loading LPE via Windows Registry - Robert Hawes
    • ALPC
      • Original
      • zeroday-powershell
        • A PowerShell example of the Windows zero day priv esc
    • Anti-Virus Software

      • #AVGater: Getting Local Admin by Abusing the Anti-Virus Quarantine

      • CVE-2018-8955: Bitdefender GravityZone Arbitrary Code Execution - Kyriakos Economou

      • COModo: From Sandbox to SYSTEM (CVE-2019–3969) - David Wells

      • Reading Physical Memory using Carbon Black's Endpoint driver - Bill Demirkapi

      • SEPM-EoP

      • Exploiting STOPzilla AntiMalware Arbitrary Write Vulnerability using SeCreateTokenPrivilege - Parvez

      • Analysis and Exploitation of an ESET Vulnerability - Tavid Ormandy(2015)

      • Compromised by Endpoint Protection - codewhitesec.blogspot

        • Symantec Endpoint Protection vulns

      • Escalating Privileges with CylancePROTECT - Ryan Hanson

      • Avira Optimizer Local Privilege Escalation - Enigma0x3

    • Other
      • One more Steam Windows Client Local Privilege Escalation 0day - Vasily Kravets
      • Local Privilege Escalation on Dell machines running Windows - Bill Demirkapi
        • This blog post will cover my research into a Local Privilege Escalation vulnerability in Dell SupportAssist. Dell SupportAssist is advertised to “proactively check the health of your system’s hardware and software”. Unfortunately, Dell SupportAsssist comes pre-installed on most of all new Dell machines running Windows. If you’re on Windows, never heard of this software, and have a Dell machine - chances are you have it installed.
      • CVE-2019-9730: LPE in Synaptics Sound Device Driver - @Jackon_T
        • CVE details for a COM-based local privilege elevation with a brief write-up on discovery to root.
      • Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation - NCCGroup
      • Elastic Boundaries – Elevating Privileges by Environment Variables Expansion - Yoam Gottesman

  • Exploits

    • CVE-2017-8759
      • Exploit toolkit CVE-2017-8759 - v1.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft .NET Framework RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter / other payload to victim without any complex configuration.
    • Win10-LPE
      • The Windows 10 LPE exploit written by SandboxEscaper. This includes the source code for the original exploit, a precompiled DLL injector binary included with the original source, and a powershell script to find potentially vulnerable libraries to overwrite for the exploit.
    • Component Services Volatile Environment LPE - bytecode77
    • CVE-2018-0952-SystemCollector
      • PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service
    • CVE-2018-8420
    • CVE-2018-8440 - PowerShell PoC
    • Remote Code Execution — Gaining Domain Admin due to a typo: CVE-2018-9022 - Daniel C
      • A short time ago as part of a red team engagement I found and successfully exploited a remote code execution vulnerability that resulted in us quickly gaining high privilege access to the customers internal network. So far nothing sounds too out of the ordinary, however interestingly the root cause of this vulnerability was due to a two character typo.
    • Another Local Privilege Escalation Vulnerability Using Process Creation Impersonation - Wayne Chin Yick Low
    • XIGNCODE3 xhunter1.sys LPE - x86.re
    • Display Languages Volatile Environment LPE - bytecode77
    • Performance Monitor Volatile Environment LPE
    • Enter Product Key Volatile Environment LPE
    • Sysprep Volatile Environment LPE(2017)
    • Remote Assistance Volatile Environment LPE
    • Display Languages Volatile Environment LPE
    • CVE-2017-12478 - Unitrends 9.x api_storage exploit
    • CVE-2020-0668
      • Use CVE-2020-0668 to perform an arbitrary privileged file move operation.
    • CVE-2019-8372: Local Privilege Elevation in LG Kernel Driver - Jackson_T
      • TL;DR: CVE for driver-based LPE with an in-depth tutorial on discovery to root and details on two new tools.
    • CVE-2020-0787 - Windows BITS - An EoP Bug Hidden in an Undocumented RPC Function - itm4n
      • This post is about an arbitrary file move vulnerability I found in the Background Intelligent Transfer Service. This is yet another example of a privileged file operation abuse in Windows 10. There is nothing really new but the bug itself is quite interesting because it was hidden in an undocumented function. Therefore, I will explain how I found it and I will also share some insights about the reverse engineering process I went through in order to identify the logic flaw.

  • Just-Enough-Administration(JEA)

    • Get $pwnd: Attacking Battle Hardened Windows Server - Lee Holmes - Defcon25
      • Windows Server has introduced major advances in remote management hardening in recent years through PowerShell Just Enough Administration ("JEA"). When set up correctly, hardened JEA endpoints can provide a formidable barrier for attackers: whitelisted commands, with no administrative access to the underlying operating system. In this presentation, watch as we show how to systematically destroy these hardened endpoints by exploiting insecure coding practices and administrative complexity.

  • Microsoft

    • From Hyper-V Admin to SYSTEM - decoder.cloud
    • Windows Credential Theft: RDP & Internet Explorer 11
      • NTLM Hashes/relay through RDP files/IE11 XXE explained

  • MSSQL

    • PowerUpSQL - 2018 Blackhat USA Arsenal
      • This is the presentation we provided at the 2018 Blackhat USA Arsenal to introduce PowerUpSQL. PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also includes many functions that can be used by administrators to quickly inventory the SQL Servers in their ADS domain and perform common threat hunting tasks related to SQL Server. This should be interesting to red, blue, and purple teams interested in automating day to day tasks involving SQL Server.

  • VirtualMachines

    • InviZzzible
      • InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them. Also, you can add and expand existing techniques yourself even without modifying the source code.

  • VMWare

    • VMware Escape Exploit
      • VMware Escape Exploit before VMware WorkStation 12.5.5
    • A bunch of Red Pills: VMware Escapes - Marco Grassi, Azureyang, Jackyxty
    • VMware Exploitation
      • A bunch of links related to VMware escape exploits

  • Access Token Manipulation

  • Accessibility Features

  • AppCert DLLs

  • AppInit DLLs

  • Application Shimming

  • Bypass User Account Control

  • DLL Search Order Hijacking

  • Exploitation for Privilege Escalation

  • Extra Window Memory Injection

  • File System Permissions Weakness

  • Hooking

  • Image File Execution Options Injection

  • New Service

  • Parent PID Spoofing

  • Path Interception

  • Port Monitors

  • PowerShell Profile

  • Process Injection

  • Scheduled Task

  • Service Registry Permissions Weakness

  • SID-History Injection

  • Valid Accounts

  • Web Shell

• Defense Evasion

  • 101
  • Articles/Blogposts/Writeups
  • Talks/Presentations/Videos
  • Tools
  • Access Token Manipulation

• Credential Access

  • 101
    • An Overview of KB2871997 - msrc-blog.ms
      • Increasing complexity of retrieving clear-text creds
    • Cached and Stored Credentials Technical Overview - docs.ms(2016)
  • Articles/Blogposts/Writeups
    • Cached and Stored Credentials - ldapwiki
    • Hunting for Credentials Dumping in Windows Environment - Teymur Kheirhabarov - ZeroNights
    • Dumping user passwords in plaintext on Windows 8.1 and Server 2012
    • Dump Windows password hashes efficiently - Part 1
    • Dumping Windows Credentials
    • Dumping Clear-Text Credentials - NetbiosX
    • Dumping user passwords in plaintext on Windows 8.1 and Server 2012 - labofapenetrationtester
    • Dumping passwords in a VMware .vmem file - Remko Weijnen
    • Password Managers: Under the Hood of Secrets Management - ISE * Password managers allow the storage and retrieval of sensitive information from an encrypted database. Users rely on them to provide better security guarantees against trivial exfiltration than alternative ways of storing passwords, such as an unsecured flat text file. In this paper we propose security guarantees password managers should offer and examine the underlying workings of five popular password managers targeting the Windows 10 platform: 1Password 7, 1Password 4, Dashlane, KeePass, and LastPass. We anticipated that password managers would employ basic security best practices, such as scrubbing secrets from memory when they are not in use and sanitization of memory once a password manager was logged out and placed into a locked state. However, we found that in all password managers we examined, trivial secrets extraction was possible from a locked password manager, including the master password in some cases, exposing up to 60 million users that use the password managers in this study to secrets retrieval from an assumed secure locked state.
    • How to retrieve user’s passwords from a Windows memory dump using Volatility - Andrea Fortuna
    • The True Story of Windows 10 and the DMA-protection - Sami Laiho
      • This blog post will tell you if / how Windows 10 protects against DMA (Direct Memory Access) bases attacks used against BitLocker and other encryption mechanisms by stealing the encryption key from the memory of a running computer. The story might be long(ish) but rest assured you want to read it through.
    • Intercepting Password Changes With Function Hooking - clymb3r
    • Dump-Clear-Text-Password-after-KB2871997-installed - 3gstudent)
  • Active Directory Environment
    • Articles/Blogposts/Writeups
      • Dumping Domain Password Hashes - pentestlab.blog
      • How Attackers Dump Active Directory Database Credentials - adsecurity.org
      • Compromising Plain Text Passwords In Active Directory
      • Safely Dumping Domain Hashes, with Meterpreter - Rapid7
      • Active Directory Domain Services Database Mounting Tool (Snapshot Viewer or Snapshot Browser) Step-by-Step Guide
        • This guide shows how you can use an improved version of Ntdsutil and a new Active Directory® database mounting tool in Windows Server® 2008 to create and view snapshots of data that is stored in Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS), without restarting the domain controller or AD LDS server. A snapshot is a shadow copy—created by the Volume Shadow Copy Service (VSS)—of the volumes that contain the Active Directory database and log files.
  • AWS
    • Articles/Blogposts/Writeups
      • CloudCopy — Stealing hashes from Domain Controllers in the Cloud - Tanner Barnes
  • Azure
    • Articles/Blogposts/Writeups
      • PowerShell, Azure, and Password Hashes in 4 steps - FortyNorth Security
        • this blog post will walk you through the process of obtaining hashes from a domain controller within Azure using PowerShell.
  • CredSSP
    • Credential theft without admin or touching LSASS with Kekeo by abusing CredSSP / TSPKG (RDP SSO) - Clement Notin
  • Dumping Credential Manager
    • Invoke-WCMDump
      • PowerShell Script to Dump Windows Credentials from the Credential Manager
  • Dumping NTDS.dit
    • Articles/Blogposts/Writeups
      • How Attackers Pull the Active Directory Database (NTDS.dit) from a Domain Controller
      • Extracting Password Hashes From The Ntds.dit File
      • Obtaining NTDS.Dit Using In-Built Windows Commands - Cyberis(2014)
      • Volume Shadow Copy NTDS.dit Domain Hashes Remotely - Part 1 - mubix
      • Getting Hashes from NTDS.dit File - swordshield.com
      • Extracting Hashes and Domain Info From ntds.dit - ropnop
      • Practice ntds.dit File Part 2: Extracting Hashes - Didier Stevens
    • Tools
      • adXtract
      • DIT Snapshot Viewer
        • DIT Snapshot Viewer is an inspection tool for Active Directory database, ntds.dit. This tool connects to ESE (Extensible Storage Engine) and reads tables/records including hidden objects by low level C API. The tool can extract ntds.dit file without stopping lsass.exe. When Active Directory Service is running, lsass.exe locks the file and does not allow to access to it. The snapshot wizard copies ntds.dit using VSS (Volume Shadow Copy Service) even if the file is exclusively locked. As copying ntds.dit may cause data inconsistency in ESE DB, the wizard automatically runs esentutil /repair command to fix the inconsistency.
      • NTDSXtract - Active Directory Forensics Framework
        • This framework was developed by the author in order to provide the community with a solution to extract forensically important information from the main database of Microsoft Active Directory (NTDS.DIT).
      • NTDSDumpEx
        • NTDS.dit offline dumper with non-elevated
      • NTDS-Extraction-Tools
        • Automated scripts that use an older version of libesedb (2014-04-06) to extract large NTDS.dit files
  • Internal Monologue
    • Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
      • In secure environments, where Mimikatz should not be executed, an adversary can perform an Internal Monologue Attack, in which they invoke a local procedure call to the NTLM authentication package (MSV1_0) from a user-mode application through SSPI to calculate a NetNTLM response in the context of the logged on user, after performing an extended NetNTLM downgrade.
  • Local Phishing
    • Articles/Blogposts/Writeups
      • Post exploitation trick - Phish users for creds on domains, from their own box
    • Tools
      • Pickl3
        • Pickl3 is Windows active user credential phishing tool. You can execute the Pickl3 and phish the target user credential.
  • Logon
    • Capturing Windows 7 Credentials at Logon Using Custom Credential Provider
      • The quick lowdown: I wrote a DLL capable of logging the credentials entered at logon for Windows Vista, 7 and future versions which you can download at http://www.leetsys.com/programs/credentialprovider/cp.zip. The credentials are logged to a file located at c:\cplog.txt. Simply copy the dll to the system32 directory and run the included register.reg script to create the necessary registry settings.
  • Keylogger
    • How to create a keylogger in PowerShell? - Juan Manuel Fernandez
    • Puffadder
      • Puffader is an opensource, hidden and undetectable keylogger for windows written in Python 2.7 which can also capture screenshots, mouse window clicks and clipboard data.
    • You Can Type, but You Can’t Hide: A Stealthy GPU-based Keylogger
      • Keyloggers are a prominent class of malware that harvests sensitive data by recording any typed in information. Key- logger implementations strive to hide their presence using rootkit-like techniques to evade detection by antivirus and other system protections. In this paper, we present a new approach for implementing a stealthy keylogger: we explore the possibility of leveraging the graphics card as an alterna- tive environment for hosting the operation of a keylogger. The key idea behind our approach is to monitor the system’s keyboard buffer directly from the GPU via DMA, without any hooks or modifications in the kernel’s code and data structures besides the page table. The evaluation of our pro- totype implementation shows that a GPU-based keylogger can effectively record all user keystrokes, store them in the memory space of the GPU, and even analyze the recorded data in-place, with negligible runtime overhead.
  • Local Files
    • Articles/Blogposts/Writeups
      • Extracting SSH Private Keys from Windows 10 ssh-agent - ropnop
      • Stored passwords found all over the place after installing Windows in company networks :( - Win-Fu Official Blog
    • Tools
      • windows_sshagent_extract
        • PoC code to extract private keys from Windows 10's built in ssh-agent service
  • Local Security Authority Subsystem Service(LSASS&LSA)
    • 101
      • Local Security Authority Subsystem Service - Wikipedia
      • Local Security Authority SubSystem Service - ldapwiki
      • Security Subsystem Architecture - 2012
      • LSA Authentication - docs.ms(2018)
    • Articles/Blogposts/Writeups
      • Dumping Lsass.exe to Disk Without Mimikatz and Extracting Credentials - @spotheplanet
      • Some ways to dump LSASS.exe - Mark Mo
      • Extract credentials from lsass remotely - hackndo
    • Tools
      • Dumpert
        • Recent malware research shows that there is an increase in malware that is using direct system calls to evade user-mode API hooks used by security products. This tool demonstrates the use of direct System Calls and API unhooking and combine these techniques in a proof of concept code which can be used to create a LSASS memory dump using Cobalt Strike, while not touching disk and evading AV/EDR monitored user-mode API calls.
    • MiniDumpWriteDump via COM+ Services DLL - modexp
    • AndrewSpecial
      • AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.
    • PhysMem2Profit
      • Physmem2profit can be used to create a minidump of a target host's LSASS process by analysing physical memory remotely. The intention of this research is to propose an alternative approach to credential theft and create a modular framework that can be extended to support other drivers that can access physical memory. Physmem2profit generates a minidump (.dmp) of LSASS that can be further analyzed with Mimikatz. The tool does not require Cobalt Strike but should work fine over beacon with a SOCKS proxy.
      • Blogpost
    • lsassy
      • Python library to remotely extract credentials on a set of hosts
      • Blogpost
  • Mimikatz/Similar
    • Official
      • "Mimikatz" - Benjamin Delpy(NoSuchCon#2)
        • Slides
      • mimikatz
      • Mimikatz Scheduled tasks Creds
      • module ~ dpapi - mimikatz
    • Using
      • Unofficial Guide to Mimikatz
      • Mimikatz Overview, Defenses and Detection
      • Mimikatz Logs and Netcat
      • Dumping a Domains worth of passwords using mimikatz
      • Mass mimikatz - hacklikeapornstar
      • Reading DPAPI Encrypted Secrets with Mimikatz and C++ -ired.team
      • How to add a Module in Mimikatz?
      • howto ~ scheduled tasks credentials - Benjamin Delpy(2017)
        • There are somes ways to get scheduled tasks passwords
      • howto ~ credential manager saved credentials - Benjamin Delpy(2017)
      • mimikatz offline addendum - francesco picasso
    • How-it-Works
      • mimikatz: deep dive on lsadump::lsa /patch and /inject - Dimitrios Slamaris
      • Walk-through Mimikatz sekurlsa module -
        • So in this post, I propose you to follow the steps I used in an attempt to understand the sekurlsa::tspkg command and reproduce its operations with WinDbg on a LSASS dump from a Windows 7 SP1 64-bits machine. We will find the secrets in the dump, and then decrypt them.
      • Exploring Mimikatz - Part 1 - WDigest - Adam Chester
    • Defense
      • Preventing Mimikatz Attacks - Panagiotis Gkatziroulis
    • Other
      • Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest
      • Windows Credential Guard & Mimikatz - nviso
      • Auto-Dumping Domain Credentials using SPNs, PowerShell Remoting, and Mimikatz - Scott Sutherland
      • Mimikatz 2.0 - Brute-Forcing Service Account Passwords
        • If everything about that ticket-generation operation is valid except for the NTLM hash, then accessing the web application will result in a failure. However, this will not cause a failed logon to appear in the Windows® event log. It will also not increment the count of failed logon attempts for the service account. Therefore, the result is an ability to perform brute-force (or, more realistically, dictionary-based) password checks for such a service account, without locking it out or generating suspicious event log entries.
      • Golden Tickets
        • mimikatz - golden ticket
        • Mimikatz 2.0 - Golden Ticket Walkthrough - Ben Lincoln
      • Skeleton Key
        • Active Directory Domain Controller Skeleton Key Malware & Mimikatz - ADSecurity
      • DCSync
        • Mimikatz DCSync Usage, Exploitation, and Detection - Sean Metcalf
      • Mimikatz and DCSync and ExtraSids, Oh My - harmj0y
      • Active Directory Attack - DCSync - c0d3xpl0it
    • DCShadow
      • DCShadow - Minimal permissions, Active Directory Deception, Shadowception and more - Nikhil Mittal
      • DCShadow
        • DCShadow is a new feature in mimikatz located in the lsadump module. It simulates the behavior of a Domain Controller (using protocols like RPC used only by DC) to inject its own data, bypassing most of the common security controls and including your SIEM. It shares some similarities with the DCSync attack (already present in the lsadump module of mimikatz).
      • Active Directory: What can make your million dollar SIEM go blind? - Vincent Le Toux, Benjamin Delpy
    • pypykatz
      • pypykatz
        • Mimikatz implementation in pure Python
      • pypykatz_server
  • Password Filter DLL
    • Credential Access – Password Filter DLL - NetbiosX
  • RDP
    • Vol de session RDP - Gentil Kiwi
    • Passwordless RDP Session Hijacking Feature All Windows versions - Alexander Korznikov
  • Volume Shadow Copy Service
    • Shadow Copy - Wikipedia
    • Manage Volume Shadow Copy Service from the Vssadmin Command-Line - technet.ms
    • vssadmin - ss64
    • vssown.vbs
    • Using Shadow Copies to Steal the SAM - dcortesi.com
  • WDigest
    • Dumping WDigest Creds with Meterpreter Mimikatz/Kiwi in Windows 8.1 - TrustedSec
  • Web Browsers
    • SharpCookieMonster
      • Extracts cookies from Chrome.
      • Blogpost
  • Tools
    • credgrap_ie_edge
      • Extract stored credentials from Internet Explorer and Edge
    • quarkspwdump
      • Dump various types of Windows credentials without injecting in any process.
    • SessionGopher
      • SessionGopher is a PowerShell tool that uses ff to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
    • CredCrack
      • CredCrack is a fast and stealthy credential harvester. It exfiltrates credentials recusively in memory and in the clear. Upon completion, CredCrack will parse and output the credentials while identifying any domain administrators obtained. CredCrack also comes with the ability to list and enumerate share access and yes, it is threaded! CredCrack has been tested and runs with the tools found natively in Kali Linux. CredCrack solely relies on having PowerSploit's "Invoke-Mimikatz.ps1" under the /var/www directory.
    • pysecdump
      • pysecdump is a python tool to extract various credentials and secrets from running Windows systems. It currently extracts:
      • LM and NT hashes (SYSKEY protected); Cached domain passwords; LSA secrets; Secrets from Credential Manager (only some)
    • Remote-Desktop-Caching-
      • This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG files to see what an attacker did on a compromised host. It is extremely useful for a forensics team to extract timestamps after an attack on a host to collect evidences and perform further analysis.

• Discovery

  • 101
  • Articles/Blogposts/Writeups
    • Windows Driver and Service enumeration with Python
    • Red Team Play-book - Initial Enumeration - HunnicCyber
    • Finding Hidden Treasure on Owned Boxes: Post-Exploitation Enumeration with wmiServSessEnum - RedXORBlue
      • TLDR: We can use WMI queries to enumerate accounts configured to run any service on a box (even non-started / disabled), as well as perform live session enumeration. Info on running the tool is in the bottom section.
    • Detecting Hypervisor Presence On Windows 10 - Daax Rynd
    • Offensive Event Parsing – Bringing Home Trophies - sixdub
    • Push it, Push it Real Good - harmj0y
    • Low Privilege Active Directory Enumeration from a non-Domain Joined Host - matt
    • Capture a Network Trace without installing anything (& capture a network trace of a reboot) - Chad Duffey(blogs.mdsn)
    • PowerQuinsta - harmj0y
    • Compliance search – a pentesters dream - Oddvar Moe
    • Remotely Enumerate Anti-Virus Configurations - FortyNorthSecurity
    • Get-MpPreference - docs.ms
    • Script to Create an Overview and Full Report of all Group Objects in a Domain - Jeremy Saunders
  • Talks/Presentations/Videos
    • Post Exploitation: Striking Gold with Covert Recon - Derek Rook(WWHF19)
      • You're on a covert penetration test focusing on the client's monitoring and alerting capabilities. You've just established a foothold, maybe even elevated to admin, but now what? You want to know more about the internal network but careless packet slinging will get you caught. Join me on a mining expedition where you can't swing your pick axe without striking gold. We'll be mining logs, pilfering connection statistics, and claim jumping process network connections. Without leaving the comfort of your beachhead, you'll be shouting "Eureka!" in no time.
  • Tools
    • PyStat
      • Advanced Netstat For Windows
    • pspy
      • pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs. Also great to demonstrate your colleagues why passing secrets as arguments on the command line is a bad idea. The tool gathers it's info from procfs scans. Inotify watchers placed on selected parts of the file system trigger these scans to catch short-lived processes.
    • forgetmenot
      • local looting script in python
    • SharpPrinter
      • SharpPrinter is a modified and console version of ListNetworks. As an example, one could execute SharpPrinter.exe through Cobalt Strike's Beacon "execute-assembly" module.
    • wmiServSessEnum
      • multithreaded .net tool that uses WMI queries to enumerate active user sessions and accounts configured to run services (even those that are stopped and disabled) on remote systems
    • MemScan
      • Quick Proof of Concept for reading a processes memory and searching for a specific string.
    • RidRelay
      • Enumerate usernames on a domain where you have no creds by using SMB Relay with low priv.
    • Eavesarp
      • A reconnaissance tool that analyzes ARP requests to identify hosts that are likely communicating with one another, which is useful in those dreaded situations where LLMNR/NBNS aren't in use for name resolution.
      • Blogpost
    • NetRipper
      • NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after decryption.

• Lateral Movement

  • Application Deployment Software

  • Component Object Model and Distributed COM

  • Exploitation of Remote Services

  • Internal Spearphishing

  • Logon Scripts

  • Pass the Hash

  • Pass the Ticket

  • Remote Desktop Protocol

  • Remote File Copy

  • Remote Services

  • Replication Through Removable Media

  • Shared Webroot

  • Taint Shared Content

  • Third-party Software

  • Windows Admin Shares

  • Windows Remote Management

  • Some Readings

    • Using Credentials to Own Windows Boxes - Part 1 (from Kali) - ropnop
    • Authenticated Remote Code Execution Methods in Windows
    • The Industrial Revolution of Lateral Movement - Tal Be'ery, Tal Maor(BH USA17)
    • Lateral Movement and Persistence: tactics vs techniques - hexacorn
    • Offensive Lateral Movement - Hausec

  • AppInit.dlls

    • AppInit DLLs and Secure Boot - docs.ms
    • AppInit_DLLs in Windows 7 and Windows Server 2008 R2 - docs.ms
    • Alternative psexec: no wmi, services or mof needed - Diablohorn
      • Poc

  • DCOM

    • Lateral movement using excel application and dcom
    • New lateral movement techniques abuse DCOM technology - Philip Tsukerman
    • Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript - Matt Nelson
    • Lateral Movement with PowerPoint and DCOM - Attactics

  • Desired State Configuration

    • Lateral Movement via Desired State Configuration(DSC) - Matt Graeber

  • Excel

    • Excel4.0 Macros - Now With Twice The Bits! - Philip Tsukerman
    • Excel4-DCOM
      • PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
    • Invoke-ExShellcode.ps1 - Philts
      • Lateral movement and shellcode injection via Excel 4.0 macros

  • NTLM Relay

    • Skip Cracking Responder Hashes and Relay Them - Richard de la Cruz

  • Pass-The-Hash

    • Articles/Blogposts/Writeups
      • Puff Puff PSExec - Jonathan Renard
      • PsExec and the Nasty Things It Can Do
        • An overview of what PsExec is and what its capabilities are from an administrative standpoint.
      • Pass-the-Hash is Dead: Long Live Pass-the-Hash - harmj0y
      • Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy - harmj0y
      • Still Passing the Hash 15 Years Later: Using Keys to the Kingdom to Access Data - BH 2012
      • Still Passing the Hash 15 Years Later
      • The Evolution of Protected Processes Part 1: Pass-the-Hash Mitigations in Windows 8.1
      • Et tu Kerberos - Christopher Campbell
        • For over a decade we have been told that Kerberos is the answer to Microsoft’s authentication woes and now we know that isn’t the case. The problems with LM and NTLM are widely known- but the problems with Kerberos have only recently surfaced. In this talk we will look back at previous failures in order to look forward. We will take a look at what recent problems in Kerberos mean to your enterprise and ways you could possibly mitigate them. Attacks such as Spoofed-PAC- Pass-the-Hash- Golden Ticket- Pass-the-Ticket and Over-Pass-the-Ticket will be explained. Unfortunately- we don’t really know what is next – only that what we have now is broken.
      • Battle Of SKM And IUM How Windows 10 Rewrites OS Architecture - Alex Ionescu - BHUSA2015
        • Slides
      • Psexec: The Ultimate Guide - Adam Bertram
      • Pass the Hash with Kerberos - mubix
        • This blog post may be of limited use, most of the time, when you have an NTLM hash, you also have the tools to use it. But, if you find yourself in a situation where you don’t have the tools and do happen to have kerberos tools, you can pass the hash with it.
    • Tools
      • smbexec
        • A rapid psexec style attack with samba tools
        • Blogpost that inspired it
      • pth-toolkit I.e Portable pass the hash toolkit
        • A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems

  • Port-Forwarding & Proxies

    • Port Forwarding in Windows - WindowsOSHub
    • WinPortPush
      • win PortPush is a small PowerShell utility used for pivoting into internal networks upon compromising a Windows public-facing host.

  • RDP

    • [RDP hijacking — how to hijack RDS and RemoteApp sessions transparently to move through an organisation - Kevin Beaumont])(https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6)
    • RDPInception - MDsec
    • The RDP Through SSH Encyclopedia - Carrie Roberts
      • I have needed to remind myself how to set up RDP access through an SSH connection so many times that I’ve decided to document it here for future reference. I hope it proves useful to you as well. I do “adversary simulation” for work and so I present this information using terms like “attacker” and “target” but this info is also useful for performing system administration tasks.
    • Remote Desktop tunneling tips & tricks - Maurizio Agazzini
    • Jumping Network Segregation with RDP - Rastamouse

  • SCM

    • Lateral Movement — SCM and DLL Hijacking Primer - Dwight Hohnstein

  • SMB

  • URL

    • Lateral movement using URL Protocol - Matt harr0ey

  • WinRM

    • PowerShell Remoting from Linux to Windows - William Martin
    • Lateral Movement – WinRM - pentestlab.blog

  • WMI

    • WMI Shell Tool
      • The WMI shell tool that we have developed allows us to execute commands and get their output using only the WMI infrastructure, without any help from other services, like the SMB server. With the wmi-shell tool we can execute commands, upload files and recover Windows passwords remotely using only the WMI service available on port 135.
    • WMIcmd
      • A command shell wrapper using only WMI for Microsoft Windows
    • No Win32_Process Needed – Expanding the WMI Lateral Movement Arsenal - Philip Tsukerman

  • Password Spraying

    • Linux
      • Raining shells on Linux environments with Hwacha
      • Hwacha
        • Hwacha is a tool to quickly execute payloads on *Nix based systems. Easily collect artifacts or execute shellcode on an entire subnet of systems for which credentials are obtained.
    • Windows
      • Use PowerShell to Get Account Lockout and Password Policy
      • DomainPasswordSpray
        • DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain.
      • DomainPasswordSpray
        • DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. It will automatically generate a userlist from the domain which excludes accounts that are expired, disabled locked out, or within 1 lockout attempt.
      • NTLM - Open-source script from root9B for manipulating NTLM authentication
        • This script tests a single hash or file of hashes against an ntlmv2 challenge/response e.g. from auxiliary/server/capture/smb The idea is that you can identify re-used passwords between accounts that you do have the hash for and accounts that you do not have the hash for, offline and without cracking the password hashes. This saves you from trying your hashes against other accounts live, which triggers lockouts and alerts.
      • CredNinja
        • A multithreaded tool designed to identify if credentials are valid, invalid, or local admin valid credentials within a network at-scale via SMB, plus now with a user hunter.
      • passpr3y
        • This is a fire-and-forget long-running password spraying tool. You hand it a list of usernames and passwords and walk away. It will perform a horizontal login attack while keeping in mind lockout times, erroneous responses, etc... Set it up on your attack box at the beginning of an assessment and check back for creds gradually over time. Output is intended to be easy to read through and grep. Focus is on simplicity.

  • (Ab)Using 'Legitimate' Applications already installed

    • How I Hacked Into Your Corporate Network Using Your Own Antivirus Agent - Angelo Ruwantha
      • Code exec through admin access to eset admin console
    • Abusing Common Cluster Configuration for Lateral Movement
      • Tech sites have published articles that walk a Windows Systems Administrator through the process of adding a machine account to the Local Administrators group on another machine. These accounts end in a $ (dollar sign) and look like SERVER$ in Active Directory. While this may be useful for simplifying the installation of clusters such as Lync, Exchange, or SQL Server, it’s not always the best idea. Servers that are set up in this way weaken the overall security posture of the cluster, and ultimately the organization, by allowing a single vulnerability or misconfiguration on one server the ability to move laterally without having to escalate privileges or compromise additional credentials. Using SQL Server as the example, any user who has READ permissions to a database essentially has SYSTEM-level permissions on a remote server. We’ll walk through that path below.

  • Tools

    • PoisonHandler
      • This technique is registering a protocol handler remotely and invoke it to execute arbitrary code on the remote host. The idea is to simply invoke start handler:// to execute commands and evade detection.

• Collection

  • 101
  • Articles/Blogposts/Writeups
    • Digging Up the Past: Windows Registry Forensics Revisited - David Via
    • Pillage Exchange - Digby
    • Pillaging .pst Files - Digby
    • File Server Triage on Red Team Engagements - harmj0y
    • No one expect command execution!
    • Decrypting IIS Passwords to Break Out of the DMZ
      • Decrypting IIS Passwords to Break Out of the DMZ: Part 1
      • Decrypting IIS Passwords to Break Out of the DMZ: Part 2
    • Recovering Plaintext Domain Credentials from WPA2 Enterprise on a Compromised Host - zc00l(2018)
  • CC
    • SearchForCC
      • A collection of open source/common tools/scripts to perform a system memory dump and/or process memory dump on Windows-based PoS systems and search for unencrypted credit card track data.
  • Code Storage
    • dvcs-ripper
      • Rip web accessible (distributed) version control systems: SVN, GIT, Mercurial/hg, bzr, ... It can rip repositories even when directory browsing is turned off.
    • cred_scanner
      • A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems.
  • KeePass
    • KeeFarce
      • Extracts passwords from a KeePass 2.x database, directly from memory.
    • KeeThief
      • Methods for attacking KeePass 2.X databases, including extracting of encryption key material from memory.
  • Outlook
    • Pillaging .pst Files
  • PCAP/Live Interface
    • net-creds
      • Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification.
    • PCredz
      • This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.
  • Skype
    • skype log viewer
      • Download and View Skype History Without Skype This program allows you to view all of your skype chat logs and then easily export them as text files. It correctly organizes them by conversation, and makes sure that group conversations do not get jumbled with one on one chats.

---

Windows Technologies

• Application Shims
  • Windows - Application Shims
• Code Signing
  • Articles/Blogposts/Writeups
    • Code Signing Certificate Cloning Attacks and Defenses - Matt Graeber
    • MetaTwin – Borrowing Microsoft Metadata and Digital Signatures to “Hide” Binaries - Joe Vest
    • Borrowing Microsoft Code Signing Certificates - lopi
    • Application of Authenticode Signatures to Unsigned Code - mattifestation
    • Subverting Trust in Windows - Matt Graeber
    • Masquerading as a Windows System Binary Using Digital Signatures - Stuart Morgan
    • Hijack Digital Signatures – PowerShell Script - pentestlab.blog
  • Talks/Videos
    • Hi, My Name is "CN=Microsoft Windows, O=Microsoft Corporation… - Matt Graeber(BlueHat IL 2018)
      • Slides
    • Subverting Sysmon - Application of a Formalized Security Product Evasion Method - Matt Graeber, Lee Christensen(BHUSA18)
  • Tools
    • certerator
      • This is the code relating to a project to simplify the act of creating a CA, signing a binary with the CA and then installing the CA on the target machine. It investigates the extent to which this can be achieved without the benefit of a GUI and shows how this can be modified to generate valid EV certificates which are trusted by Windows. It is intended for penetration testers who are looking to install an implant binary which looks as legitimate as possible. None of these techniques are new, but it is hoped that this tool and project will make them easier and more accessible.
• ClickOnce Applications
  • ClickOnce - Wikipedia
  • ClickOnce security and deployment - docs.ms
  • ClickOnce Deployment for Windows Forms - docs.ms
  • ClickOnce Applications in Enterprise Environments - Remko Weijnen
    • ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.
  • Eight Evil Things Microsoft Never Showed You in the ClickOnce Demos (and What You Can Do About Some of Them) - Chris Williams
• DPAPI
  • 101
    • CNG DPAPI - docs.ms
    • Data Protection API - Wikipedia
    • DPAPI Secrets. Security analysis and data recovery in DPAPI - Passcape
    • [Windows Data Protection - docs.ms(WinXP)](https://docs.microsoft.com/en-us/previous-versions/ms995355(v=msdn.10)
    • module ~ dpapi - mimikatz
  • Articles/Blogposts/Writeups
    • DPAPI Primer for Pentesters - WebstersProdigy
    • Grab the Windows secrets! - decoder.cloud
    • DPAPI exploitation during pentest and password cracking - Jean-Christophe Delaunay
    • Happy DPAPI! - ZenaForensics
    • ReVaulting! Decryption and opportunities - Reality Net System Solutions
    • Windows ReVaulting - digital-forensics.it
    • TBAL: an (accidental?) DPAPI Backdoor for local users - vztekoverflow
    • Operational Guidance for Offensive User DPAPI Abuse - harmj0y
    • Offensive Encrypted Data Storage (DPAPI edition) - harmj0y
    • A Case Study in Attacking KeePass - harmj0y
    • Reading DPAPI Encrypted Secrets with Mimikatz and C++ -ired.team
    • Retrieving DPAPI Backup Keys from Active Directory - Michael Grafnetter
  • Talks & Presentations
    • The BlackBox of DPAPI: The Gift That Keeps on Giving - Bart Inglot
    • DPAPI and DPAPI-NG: Decryption Toolkit - Paula Januskiewicz
      • Tools/Blogpost
    • Protecting browsers’ secrets in a domain environment - Itai Grady
      • All popular browsers allow users to store sensitive data such as credentials for online and cloud services (such as social networks, email providers, and banking) and forms data (e.g. Credit card number, address, phone number) In Windows environment, most browsers (and many other applications) choose to protect these secrets by using Window Data Protection API (DPAPI), which provides an easy method to encrypt and decrypt secret data. Lately, Mimikatz, a popular pentest/hacking tool, was updated to include a functionality that allows highly-privileged attackers to decrypt all of DPAPI secrets. In this talk, I will analyze the Mimikatz Anti-DPAPI attack targeting the Domain Controller (DC) which puts all DPAPI secrets in peril and show how it can be defeated with network monitoring.
    • Decrypting DPAPI data - Jean-Michel Picod, Elie Bursztein
    • give me the password and I'll rule the world: dpapi, what else? - Francesco Picasso
    • DPAPI exploitation during pentest and password cracking - Jean-Christophe Delaunay
    • ReVaulting! Decryption and opportunities - Francesco Picasso
      • Windows credentials manager stores users’ credentials in special folders called vaults. Being able to access such credentials could be truly useful during a digital investigation for example, to gain access to other protected systems. Moreover, if data is in the cloud, there is the need to have the proper tokens to access it. This presentation will describe vaults’ internals and how they can be decrypted; the related Python Open Source code will be made publicly available. During the session, credentials and vaults coming from Windows 7, Windows 8.1 and Windows 10 will be decrypted, focusing on particular cases of interest. Finally, the presentation will address the challenges coming from Windows Phone, such as getting system-users’ passwords and obtaining users’ ActiveSync tokens.
  • Tools
    • dpapick
      • DPAPIck is a forensic toolkit, written in Python and designed to easily deal with Microsoft DPAPI blob decryption in an offline and cross-platform way.
    • Windows DPAPI Lab
      • My own DPAPI laboratory. Here I put some ongoing works that involve Windows DPAPI (Data Protection API). It's a lab, so something could not work: please see "How to Use".
    • The LaZagne Project
      • LaZagne uses an internal Windows function called CryptUnprotectData to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started (when the analysis is realized on an offline mounted disk), or if we do not want to drop a binary on the remote host, no passwords can be retrieved. LaZagneForensic has been created to avoid this problem. This work has been mainly inspired by the awesome work done by Jean-Michel Picod and Elie Bursztein for DPAPICK and Francesco Picasso for Windows DPAPI laboratory.
    • DataProtectionDecryptor v1.06 - Nirsoft
• ETW
  • 101
    • Event Tracing - docs.ms
    • About Event Tracing - docs.ms
    • Using Event Tracing - docs.ms
  • Articles/Blogposts/Writeups
    • SilkETW: Because Free Telemetry is … Free! - Ruben Boonnen
      • Slides
    • Tampering with Windows Event Tracing: Background, Offense, and Defense - Palantir
    • Getting started with Event Tracing for Windows in C# - Alex Khanin
    • ETW Event Tracing for Windows and ETL Files - Nicole Ibrahim
  • Talks/Videos
    • Production tracing with Event Tracing for Windows (ETW) - Doug Cook
    • ETW - Monitor Anything, Anytime, Anywhere - Dina Goldshtein(NDC Oslo 2017)
      • You’ll learn how to diagnose incredibly complex issues in production systems such as excessive garbage collection pauses, slow startup due to JIT and disk accesses, and even sluggishness during the Windows boot process. We will also explore some ways to automate ETW collection and analysis to build self-diagnosing applications that identify high CPU issues, resource leaks, and concurrency problems and produce alerts and reports. In the course of the talk we will use innovative performance tools that haven’t been applied to ETW before — flame graphs for visualising call stacks and a command-line interface for dynamic, scriptable ETW tracing. ETW is truly a window into everything happening on your system, and it doesn’t require expensive licenses, invasive tools, or modifying your code in any way. It is a critical, first-stop skill on your way to mastering application performance and diagnostics.
  • Tools
    • SilkETW & SilkService
      • SilkETW & SilkService are flexible C# wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection. While both projects have obvious defensive (and offensive) applications they should primarily be considered as research tools. For easy consumption, output data is serialized to JSON. The JSON data can either be written to file and analyzed locally using PowerShell, stored in the Windows eventlog or shipped off to 3rd party infrastructure such as Elasticsearch.
• Fibers
  • 101
    • Fibers - docs.ms
  • Articles/Blogposts/Writeups
• LNK Files
  • Suspected Sapphire Mushroom (APT-C-12) malicious LNK files - @mattnotmax
  • The Missing LNK — Correlating User Search LNK files - Ashley Frazer
  • Analyzing the Windows LNK file attack method - 0xd3xt3r
• Logging
  • Articles/Blogposts/Writeups
  • Tools
    • Invoke-Phant0m
      • This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
    • GENE: Go Evtx sigNature Engine
      • The idea behind this project is to provide an efficient and standard way to look into Windows Event Logs (a.k.a EVTX files). For those who are familiar with Yara, it can be seen as a Yara engine but to look for information into Windows Events.
      • Documentation
• Named Pipes
  • Named Pipe - Wikipedia
  • Named Pipes - docs.ms
  • Named Pipe Security and Access Rights - docs.ms
  • Named Pipe client
• PowerShell Desired State Configuration
  • Documentation
    • Windows PowerShell Desired State Configuration Overview - docs.ms
  • DSCompromised: A Windows DSC Attack Framework - Matt Hastings, Ryan Kazanciyan - BH Asia16
  • DSCompromised
    • PowerShell framework for managing and infecting systems via Windows Desired State Configuration (DSC) DSC is a built-in feature in Windows Management Framework 4.0 (PowerShell v4) and is installed natively on Windows operating systems beginning with Server 2012 R2 and Windows 8.1.
• Windows Communication Foundation
  • 101
    • What Is Windows Communication Foundation - docs.ms
    • Best Practices for Security in WCF - docs.ms
  • Articles/Blogposts/Writeups
    • Windows Communication Foundation(WCF) FAQ: Part I - Shivprasd(C#Corner)
    • Abusing Insecure Windows Communication Foundation (WCF) Endpoints - Fabius Watson
    • Exploitation of Remote WCF Vulnerabilities - Versprite
    • Abusing WCF Endpoints for Fun and Profit
    • Finding and Exploiting .NET Remoting over HTTP using Deserialisation - Sorush Dalili
  • Talks/Presentations/Videos
• Windows Notification Facility
  • Playing with the Windows Notification Facility (WNF) - Gwaby
• Windows Scripting Host
  • 101
    • Windows Scripting Host - Wikipedia
    • Windows Script Host - docs.ms
      • The following sections provide information about Windows Script Host along with a reference section that documents the object model.
    • wscript - docs.ms
      • Windows Script Host provides an environment in which users can execute scripts in a variety of languages that use a variety of object models to perform tasks.
    • Scripting - docs.ms
      • Windows Script is a comprehensive scripting infrastructure for the Microsoft® Windows® platform. Windows Script provides two script engines, Visual Basic® Scripting Edition and Microsoft JScript®, which can be embedded into Windows Applications. It also provides an extensive array of supporting technologies that makes it easier for script users to script Windows applications.
  • Articles/Blogposts/Writeups
    • Is VBScript or VBA Dead/Dying? - isvbscriptdead.com
    • WSH - Windows Script Host - Rob Van der Woude
    • Windows Script Host (jscript): how do i download a binary file? - StackOverflow
    • WSH - Windows Script Host - renenyffenegger.ch
• Malicious Butler
  • The Remote Malicious Butler Did It! - Tal Be'ery, Chaim Hoch(BHUSA 2015)
    • An Evil Maid attack is a security exploit that targets a computing device that has been left unattended. An evil maid attack is characterized by the attacker's ability to physically access the target multiple times without the owner's knowledge. On BlackHat Europe 2015, Ian Haken in his talk "Bypassing Local Windows Authentication to Defeat Full Disk Encryption" had demonstrated a smart Evil Maid attack which allows the attacker to bypass Bitlocker disk encryption in an enterprise's domain environment. The attacker can do so by connecting the unattended computer into a rogue Domain Controller and abusing a client side authentication vulnerability. As a result, Microsoft had released a patch to fix this vulnerability and mitigate the attack. While being a clever attack, the physical access requirement for the attack seems to be prohibitive and would prevent it from being used on most APT campaigns. As a result, defenders might not correctly prioritize the importance of patching it. In our talk, we reveal the "Remote Malicious Butler" attack, which shows how attackers can perform such an attack, remotely, to take a complete control over the remote computer. We will dive into the technical details of the attack including the rogue Domain Controller, the client-side vulnerability and the Kerberos authentication protocol network traffic that ties them. We would explore some other attack avenues, all leveraging on the rogue Domain Controller concept. We would conclude with the analysis of some practical generic detection and prevention methods against rogue Domain Controllers.
  • Slides

---

Active Directory

• 101
  • What is Active Directory Domain Services and how does it work?
  • The Most Common Active Directory Security Issues and What You Can Do to Fix Them - Sean Metcalf
  • What is Active Directory Red Forest Design? - social.technet.ms
  • Presentations by Sean Metcalf(ADSecurity.org)
  • Articles/Blogposts/Writeups
    • Beyond Domain Admins – Domain Controller & AD Administration - ADSecurity.org
      • This post provides information on how Active Directory is typically administered and the associated roles & rights.
    • Setting up Samba as a Domain Member
  • Talks/Videos
    • Beyond the MCSE: Active Directory for the Security Professional - Sean Metcalf(BHUSA 2016)
      • Active Directory (AD) is leveraged by 95% of the Fortune 1000 companies for its directory, authentication, and management capabilities. This means tSMBhat both Red and Blue teams need to have a better understanding of Active Directory, it's security, how it's attacked, and how best to align defenses. This presentation covers key Active Directory components which are critical for security professionals to know in order to defend AD. Properly securing the enterprise means identifying and leveraging appropriate defensive technologies. The provided information is immediately useful and actionable in order to help organizations better secure their enterprise resources against attackers. Highlighted are areas attackers go after including some recently patched vulnerabilities and the exploited weaknesses. This includes the critical Kerberos vulnerability (MS14-068), Group Policy Man-in-the-Middle (MS15-011 & MS15-014) and how they take advantages of AD communication.
  • Attacking101
    • Articles/Blogposts/Writeups
      • Active Directory Security Workshop: A Red and Blue Guide to Popular AD Attacks - @_theViVi(AfricaHackon2019)
      • Active Directory Kill Chain Attack & Defense - infosecn1nja
        • This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are leveraging to compromise active directory and guidance to mitigation, detection, and prevention. And understand Active Directory Kill Chain Attack and Modern Post Exploitation Adversary Tradecraft Activity.
      • Penetration Testing Active Directory, Part I - Hausec
        • Part II
      • Active Directory Attacks - PayloadsAllTheThings
      • Pen Testing Active Directory Series - Andy Green
    • Talks/Videos
      • Offensive Active Directory with Powershell - harmj0y(Troopers2016)
      • Abusing Active Directory in Post-Exploitation - Carlos Perez(Derbycon4)
        • Windows APIs are often a blackbox with poor documentation, taking input and spewing output with little visibility on what actually happens in the background. By reverse engineering (and abusing) some of these seemingly benign APIs, we can effectively manipulate Windows into performing stealthy custom attacks using previously unknown persistent and injection techniques. In this talk, we’ll get Windows to play with itself nonstop while revealing 0day persistence, previously unknown DLL injection techniques, and Windows API tips and tricks. To top it all off, a custom HTTP beaconing backdoor will be released leveraging the newly released persistence and injection techniques. So much Windows abuse, so little time.
      • Beyond the MCSE: Red Teaming Active Directory - Sean Metcalf
      • Red vs Blue: Modern Active Directory Attacks & Defense - Sean Metcalf(Defcon23)
      • Red Vs. Blue: Modern Active Directory Attacks, Detection, And Protection - Sean Metcalf(BHUSA15)
        • Kerberos "Golden Tickets" were unveiled by Alva "Skip" Duckwall & Benjamin Delpy in 2014 during their Black Hat USA presentation. Around this time, Active Directory (AD) admins all over the world felt a great disturbance in the Force. Golden Tickets are the ultimate method for persistent, forever AD admin rights to a network since they are valid Kerberos tickets and can't be detected, right? The news is filled with reports of breached companies and government agencies with little detail on the attack vectors and mitigation. This briefing discusses in detail the latest attack methods for gaining and maintaining administrative access in Active Directory. Also covered are traditional defensive security measures that work (and ones that don't) as well as the mitigation strategies that can keep your company's name off the front page. Prepare to go beyond "Pass-the-Hash" and down the rabbit hole. This talk explores the latest Active Directory attack vectors and describes how Golden Ticket usage can be detected. When forged Kerberos tickets are used in AD, there are some interesting artifacts that can be identified. Yes, despite what you may have read on the internet, there are ways to detect Golden & Silver Ticket usage!
• Active Directory Attributes & Technologies
  • Active Directory Service Interaces
    • 101
      • Active Directory Service Interfaces - docs.ms
    • Articles/Blogposts/Writeups
    • Talks/Videos
    • Tools
      • AdsiPS
        • PowerShell module to interact with Active Directory using ADSI and the System.DirectoryServices namespace (.NET Framework).
  • AD Permissions/Rights
    • 101
      • Extended Rights Reference - docs.ms
        • This page lists all the extended rights available for delegation in Active Directory. These rights have been categorized according to the object (such as the user account object) that the right applies to; each listing includes the extended right name, a brief description, and the object GUID required when writing a script to delegate that right.
  • Groups
    • 101
      • Active Directory Security Groups - docs.ms
  • Account Logon History
    • Get All AD Users Logon History with their Logged on Computers (with IPs)& OUs
      • This script will list the AD users logon information with their logged on computers by inspecting the Kerberos TGT Request Events(EventID 4768) from domain controllers. Not Only User account Name is fetched, but also users OU path and Computer Accounts are retrieved. You can also list the history of last logged on users. In Environment where Exchange Servers are used, the exchange servers authentication request for users will also be logged since it also uses EventID (4768) to for TGT Request. You can also export the result to CSV file format. Powershell version 3.0 is needed to use the script.
  • ADFS
    • 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen
    • Using PowerShell to Identify Federated Domains
    • LyncSniper: A tool for penetration testing Skype for Business and Lync deployments
    • Sniffing and replaying ADFS claims with Fiddler! - Paula Januszkiewicz
    • Attacking ADFS Endpoints with PowerShell
  • AdminSDHolder
    • Reference Material | Understanding Privileged Accounts and the AdminSDHolder - Specopssoft.com
    • Five common questions about AdminSdHolder and SDProp - blogs.technet
    • Sneaky Active Directory Persistence #15: Leverage AdminSDHolder & SDProp to (Re)Gain Domain Admin Rights
    • Persistence Using Adminsdholder And Sdprop
    • AdminSDHolder, Protected Groups and SDPROP - John Policelli - docs.ms
  • ATA
    • ATA Suspicious Activity Playbook - technet.ms
  • (Discretionary)Access Control Lists
    • Articles/Blogposts/Writeups
      • Here Be Dragons The Unexplored Land of Active Directory ACLs - Andy Robbins, Will Schroeder, Rohan(Derbycon7)
      • An ACE Up the Sleeve: Designing Active Directory DACL Backdoors
      • Shadow Admins – The Stealthy Accounts That You Should Fear The Most
      • The Unintended Risks of Trusting Active Directory
      • Exploiting Weak Active Directory Permissions With Powersploit
      • Abusing Active Directory Permissions with PowerView
      • BloodHound 1.3 – The ACL Attack Path Update
      • Scanning for Active Directory Privileges & Privileged Accounts
      • Active Directory Access Control List – Attacks and Defense
      • Abusing Active Directory ACLs/ACEs - ired.team
      • Escalating privileges with ACLs in Active Directory - Rindert Kramer and Dirk-jan Mollema(Fox-IT)
        • During internal penetration tests, it happens quite often that we manage to obtain Domain Administrative access within a few hours. Contributing to this are insufficient system hardening and the use of insecure Active Directory defaults. In such scenarios publicly available tools help in finding and exploiting these issues and often result in obtaining domain administrative privileges. This blogpost describes a scenario where our standard attack methods did not work and where we had to dig deeper in order to gain high privileges in the domain. We describe more advanced privilege escalation attacks using Access Control Lists and introduce a new tool called Invoke-Aclpwn and an extension to ntlmrelayx that automate the steps for this advanced attack.
      • Viewing Service ACLs - rohnspowershellblog(2013)
      • Modifying Service ACLs - rohnspowershellblog(2014)
        • In my last post, I showed an early version of a function to get the Discretionary Access Control List (DACL) of a Windows service. In this post, I’m going to show a newer version of that function, along with a function to change the DACL, and a helper function to create Access Control Entries (ACEs). The source code is quite a bit longer, so I’m not going to walk through each bit of code. What I will do is give a brief overview of each of the three functions, along with some examples of how to use them. I’ll also mention where I plan to take the functions in the future. I’ll include the source code of the functions as they currently stand at the end of the post. Included in the source code is comment based help for each of the three functions.
      • AD Privilege Escalation Exploit: The Overlooked ACL - David Rowe
    • Talks & Presentations
      • aclpwn - Active Directory ACL exploitation with BloodHound
      • Invoke-ACLpwn
        • Invoke-ACLpwn is a tool that automates the discovery and pwnage of ACLs in Active Directory that are unsafe configured.
    • Tools
      • Windows DACL Enum Project
        • A collection of tools to enumerate and analyse Windows DACLs
      • DAMP - The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.
        • This project contains several files that implement host-based security descriptor "backdoors" that facilitate the abuse of various remotely accessible services for arbitrary trustees/security principals. tl;dr - this grants users/groups (local, domain, or 'well-known' like 'Everyone') of an attacker's choosing the ability to perform specific administrative actions on a modified host without needing membership in the local administrators group. Note: to implement these backdoors, you need the right to change the security descriptor information for the targeted service, which in stock configurations nearly always means membership in the local administrators group.
  • DNS
    • Articles/Blogposts/Writeups
      • Abusing DNSAdmins privilege for escalation in Active Directory
      • From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration
      • AD Zone Transfers as a user - mubix
      • Feature, not bug: DNSAdmin to DC compromise in one line - Shay Ber
      • Getting in the Zone: dumping Active Directory DNS using adidnsdump - Dirk-jan Mollema
        • Zone transfers are a classical way of performing reconnaissance in networks (or even from the internet). They require an insecurely configured DNS server that allows anonymous users to transfer all records and gather information about host in the network. What not many people know however is that if Active Directory integrated DNS is used, any user can query all the DNS records by default. This blog introduces a tool to do this and describes a method to do this even for records normal users don’t have read rights for.
      • Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS - Kevin Robertson
      • Compiling a DLL using MingGW - mubix
        • Compiling a DLL using MingGW to pull of the DNSAdmins attack
      • Feature, not bug: DNSAdmin to DC compromise in one line - Shay Ber(2017)
      • Abusing DNSAdmins privilege for escalation in Active Directory - Nikil Mittal(2017)
    • Tools
      • DnsCache
        • This is a reference example for how to call the Windows API to enumerate cached DNS records in the Windows resolver. Proof of concept or pattern only.
      • adidnsdump
        • By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks.
        • Blogpost
  • Domain Trusts
    • Domain Trusts: Why You Should Care
    • Trusts You Might Have Missed
    • A Guide to Attacking Domain Trusts - harmj0y
    • Domain Trusts: We’re Not Done Yet - harmj0y
    • The Trustpocalypse - harmj0y
    • Subverting Trust in Windows - Matt Graeber
    • A Guide to Attacking Domain Trusts - harmj0y
    • Trust Direction: An Enabler for Active Directory Enumeration and Trust Exploitation - BOHOPS
  • Forests
    • How Domain and Forest Trusts Work - docs.ms
    • How NOT to use the PAM trust - Leveraging Shadow Principals for Cross Forest Attacks - Nikhil Mittal
  • Groups
    • A Pentester’s Guide to Group Scoping - harmj0y
  • Group Policy
    • 101
      • Group Policy - Wikipedia
      • Group Policy Overview - docs.ms
      • Group Policy Architecture - docs.ms
    • Articles/Blogposts/Writeups
      • Abusing GPO Permissions - harmj0y
      • Sneaky Active Directory Persistence #17: Group Policy
      • A Red Teamer’s Guide to GPOs and OUs
      • File templates for GPO Abuse
      • GPO Abuse - Part 1
      • Local Group Enumeration - harmj0y
      • Where My Admins At? (GPO Edition) - harmj0y
      • Bypassing Group Policy Proxy Settings Using The Windows Registry - Scriptmonkey
    • Talks & Presentations
      • Get-GPTrashFire - Mike Loss(BSides Canberra2018)
        • Identifying and Abusing Vulnerable Configurations in MS AD Group Policy
        • Slides Tools
      • Grouper
        • Grouper is a slightly wobbly PowerShell module designed for pentesters and redteamers (although probably also useful for sysadmins) which sifts through the (usually very noisy) XML output from the Get-GPOReport cmdlet (part of Microsoft's Group Policy module) and identifies all the settings defined in Group Policy Objects (GPOs) that might prove useful to someone trying to do something fun/evil.
      • Grouper2
        • Grouper2 is a tool for pentesters to help find security-related misconfigurations in Active Directory Group Policy. It might also be useful for other people doing other stuff, but it is explicitly NOT meant to be an audit tool. If you want to check your policy configs against some particular standard, you probably want Microsoft's Security and Compliance Toolkit, not Grouper or Grouper2.
      • SharpGPO-RemoteAccessPolicies
        • A C# tool for enumerating remote access policies through group policy.
      • Get-GPTrashFire
        • Identifiying and Abusing Vulnerable Configuraitons in MS AD Group Policy
      • SharpGPOAbuse
        • SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO. Blogpost
      • GetVulnerableGPO
        • PowerShell script to find 'vulnerable' security-related GPOs that should be hardended
      • Policy Plus
        • Local Group Policy Editor plus more, for all Windows editions.
  • Kerberos
    • 101
      • Kerberos (I): How does Kerberos work? – Theory - Eloy Perez
      • Kerberos (II): How to attack Kerberos? - Eloy Perez
        • In this article about Kerberos, a few attacks against the protocol will be shown. In order to refresh the concepts behind the following attacks, it is recommended to check the first part of this series which covers Kerberos theory. * Kerberos Attacks Questions - social.technet.ms
      • Explain like I’m 5: Kerberos - Lynn Roots
      • Abusing Microsoft Kerberos: Sorry You Guys Don't Get It - Alva Duckwall, Benjamin Delpy(BHUSA 2015)
        • Microsoft Active Directory uses Kerberos to handle authentication requests by default. However, if the domain is compromised, how bad can it really be? With the loss of the right hash, Kerberos can be completely compromised for years after the attacker gained access. Yes, it really is that bad. In this presentation Skip Duckwall, @passingthehash on twitter and Benjamin Delpy, @gentilkiwi on twitter and the author of Mimikatz, will demonstrate just how thoroughly compromised Kerberos can be under real world conditions.
    • Articles/Writeups
      • How To Attack Kerberos 101 - m0chan
      • Kerberos, Active Directory’s Secret Decoder Ring - Sean Metcalf
      • Credential cache - MIT Kerberos Documentation
      • Kerberos Authentication problems – Service Principal Name (SPN) issues – Part 1 - blogs.technet
      • Security Focus: Analysing 'Account is sensitive and cannot be delegated' for Privileged Accounts - Ian Fann(2015)
      • Delegating like a boss: Abusing Kerberos Delegation in Active Directory - Kevin Murphy
        • I wanted to write a post that could serve as a (relatively) quick reference for how to abuse the various types of Kerberos delegation that you may find in an Active Directory environment during a penetration test or red team engagement.
    • Talks & Presentations
      • Attacking Microsoft Kerberos: Kicking the Guard Dog of Hades
        • Kerberos- besides having three heads and guarding the gates of hell- protects services on Microsoft Windows Domains. Its use is increasing due to the growing number of attacks targeting NTLM authentication. Attacking Kerberos to access Windows resources represents the next generation of attacks on Windows authentication.In this talk Tim will discuss his research on new attacks against Kerberos- including a way to attack the credentials of a remote service without sending traffic to the service as well as rewriting tickets to access systems.He will also examine potential countermeasures against Kerberos attacks with suggestions for mitigating the most common weaknesses in Windows Kerberos deployments.
      • Et tu - Kerberos?
        • For over a decade we have been told that Kerberos is the answer to Microsoft’s authentication woes and now we know that isn’t the case. The problems with LM and NTLM are widely known- but the problems with Kerberos have only recently surfaced. In this talk we will look back at previous failures in order to look forward. We will take a look at what recent problems in Kerberos mean to your enterprise and ways you could possibly mitigate them. Attacks such as Spoofed-PAC- Pass-the-Hash- Golden Ticket- Pass-the-Ticket and Over-Pass-the-Ticket will be explained. Unfortunately- we don’t really know what is next – only that what we have now is broken.
      • Attacking Kerberos: Kicking the Guard Dog of Hades
      • Kerberos Party Tricks: Weaponizing Kerberos Protocol Flaws - Exumbraops.com
      • Abusing Microsoft Kerberos: Sorry You Guys Don't Get It - Alva Duckwall and Benjamin Delpy(BHUSA 2014)
        • "Microsoft Active Directory uses Kerberos to handle authentication requests by default. However, if the domain is compromised, how bad can it really be? With the loss of the right hash, Kerberos can be completely compromised for years after the attacker gained access. Yes, it really is that bad. In this presentation Skip Duckwall, @passingthehash on twitter and Benjamin Delpy, @gentilkiwi on twitter and the author of Mimikatz, will demonstrate just how thoroughly compromised Kerberos can be under real world conditions. Prepare to have all your assumptions about Kerberos challenged!"
        • Slides
      • Return From The Underworld - The Future Of Red Team Kerberos - Jim Shaver & Mitchell Hennigan
      • You (dis)liked mimikatz? Wait for kekeo - Benjamin Delpy(BlueHat IL 2019)
    • Tools
      • Kerberos Party Tricks: Weaponizing Kerberos Protocol Flaws - Geoffrey Janja
        • Slides
      • kekeo
        • A little toolbox to play with Microsoft Kerberos in C
      • PyKEK
        • PyKEK (Python Kerberos Exploitation Kit), a python library to manipulate KRB5-related data. (Still in development)
      • Kerberom
        • Kerberom is a tool aimed to retrieve ARC4-HMAC'ed encrypted Tickets Granting Service (TGS) of accounts having a Service Principal Name (SPN) within an Active Directory
      • Kerbrute - ropnop
        • A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication
      • kerbrute - Tarlogic
        • An script to perform kerberos bruteforcing by using the Impacket library.
  • LDAP
    • Articles/Writeups
      • LDAP Swiss Army Knife - Moritz Bechler
      • Fun with LDAP and Kerberos: Attacking AD from non-Windows machines - Ronnie Flathers(TR19)
        • Slides
      • Faster Domain Escalation using LDAP - Scott Sutherland
      • LDAP Injection Cheat Sheet, Attack Examples & Protection - Checkmarx
    • Talks & Presentations
      • Fun with LDAP and Kerberos: Attacking AD from non-Windows machines - Ronnie Flathers(Troopers19)
        • Slides
        • You don’t need Windows to talk to Windows. This talk will explain and walk through various techniques to (ab)use LDAP and Kerberos from non-Windows machines to perform reconnaissance, gain footholds, and maintain persistence, with an emphasis on explaining how the attacks and protocols work. This talk will walk through some lesser known tools and techniques for doing reconnaissance and enumeration in AD environments, as well as gaining an initial foothold, and using credentials in different, stealthier ways (i.e. Kerberos). While tools like Bloodhound, CrackMapExec and Deathstar have made footholds and paths to DA very easy and automated, this talk will instead discuss how tools like this work “under-the-hood” and will stress living off the land with default tools and manual recon and exploitation. After discussing some of the technologies and protocols that make up Active Directory Domain Services, I’ll explain how to interact with these using Linux tools and Python. You don’t need a Windows foothold to talk Windows - everything will be done straight from Linux using DNS, LDAP, Heimdal Kerberos, Samba and Python Impacket.
    • Tools
      • LDAPDomainDump
        • In an Active Directory domain, a lot of interesting information can be retrieved via LDAP by any authenticated user (or machine). This makes LDAP an interesting protocol for gathering information in the recon phase of a pentest of an internal network. A problem is that data from LDAP often is not available in an easy to read format. ldapdomaindump is a tool which aims to solve this problem, by collecting and parsing information available via LDAP and outputting it in a human readable HTML format, as well as machine readable json and csv/tsv/greppable files.
      • windapsearch
        • windapsearch is a Python script to help enumerate users, groups and computers from a Windows domain through LDAP queries. By default, Windows Domain Controllers support basic LDAP operations through port 389/tcp. With any valid domain account (regardless of privileges), it is possible to perform LDAP queries against a domain controller for any AD related information. You can always use a tool like ldapsearch to perform custom LDAP queries against a Domain Controller. I found myself running different LDAP commands over and over again, and it was difficult to memorize all the custom LDAP queries. So this tool was born to help automate some of the most useful LDAP queries a pentester would want to perform in an AD environment.
  • LAPS
    • 101
      • Local Administrator Password Solution - docs.ms
    • Articles/Blogposts/Writeups
      • Running LAPS with PowerView - harmj0y
      • RastaMouse LAPS Part 1 & 2
      • Mise en place d'une Backdoor LAPS via modification de l'attribut SearchFlags avec DCShadow - Gregory Lucand
      • Malicious use of Microsoft LAPS - akijos
      • Microsoft LAPS Security & Active Directory LAPS Configuration Recon - adsecurity.org
      • Running LAPS Around Cleartext Passwords - Karl Fosaaen
    • Tools
      • LAPSToolkit
        • Tool to audit and attack LAPS environments
  • Lync
    • LyncSniper
      • A tool for penetration testing Skype for Business and Lync deployments
      • Blogpost/Writeup
    • LyncSmash
      • a collection of tools to enumerate and attack self-hosted Skype for Business and Microsoft Lync installations
      • Talk
      • Slides
  • MachineAccountQuota
    • MS-DS-Machine-Account-Quota attribute - docs.ms
      • The number of computer accounts that a user is allowed to create in a domain.
    • MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory’s Oddest Settings - Kevin Robertson(2019)
    • MachineAccountQuota Transitive Quota: 110 Accounts and Beyond - Kevin Robertson(2019)
    • PowerMAD
      • PowerShell MachineAccountQuota and DNS exploit tools
      • Blogpost
  • MS SQL Server * Hacking SQL Server on Scale with PowerShell - Secure360 2017 * Using SQL Server for attacking a Forest Trust * PowerUpSQL * 2018 Blackhat USA Arsenal Presentation * SQL Server – Link… Link… Link… and Shell: How to Hack Database Links in SQL Server! - Annti Rantasaari(2013)
  • NTLM
    • Pwning with Responder – A Pentester’s Guide
    • Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes)
    • Relaying credentials everywhere with ntlmrelayx
  • Read-Only Domain Controllers
    • Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory
  • Red Forest
    • Attack and defend Microsoft Enhanced Security Administrative
  • Service Principal Names
    • 101
      • Service Principal Names - docs.ms
      • Service Principal Names - docs.ms(older documentation)
      • Register a Service Principal Name for Kerberos Connections - docs.ms
    • Articles/Blogposts/Writeups
      • Active Directory Pentest Recon Part 1: SPN Scanning aka Mining Kerberos Service Principal Names - Sean Metcalf
      • SPN Discovery - pentestlab.blog
      • Service Principal Name (SPN) - hackndo
  • System Center Configuration Manager
    • Targeted Workstation Compromise with SCCM - enigma0x3
      • LM Hash and NT Hash - AD Shot Gyan
    • Using SCCM to violate best practices - cr0n1c
  • Trusts
    • 101
    • Articles/Blogposts/Writeups
      • A Guide to Attacking Domain Trusts
      • It's All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Active Directory Trusts
      • Active Directory forest trusts part 1 - How does SID filtering work?
      • The Forest Is Under Control. Taking over the entire Active Directory forest
      • [Not A Security Bou* Read-Only Domain Controllers
      • Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory
      • Not a Security Boundary: Breaking Forest Trusts](https://posts.specterops.io/not-a-security-boundary-breaking-forest-trusts-cd125829518d)
      • Pentesting Active Directory Forests
      • Active Directory forest trusts part 1 - How does SID filtering work? - Dirk-jan Mollema
      • The Trustpocalypse
    • WSUS
      • WSUSPect - Compromising the Windows Enterprise via Windows Update - Paul Stone, Alex Chapman - BHUS15
        • Blogpost)
        • Slides
      • WSuspect Proxy
        • WSUSpect Proxy - a tool for MITM'ing insecure WSUS connections
      • WSUSpendu
        • Implement WSUSpendu attack
• Attack(s/ing)a
  • Hunting Users
    • Articles/Blogposts/Writeups
      • Derivative Local Admin - sixdub
      • Active Directory Control Paths
        • Control paths in Active Directory are an aggregation of "control relations" between entities of the domain (users, computers, groups, GPO, containers, etc.) which can be visualized as graphs (such as above) and whose purpose is to answer questions like "Who can get 'Domain Admins' privileges ?" or "What resources can a user control ?" and even "Who can read the CEO's emails ?".
      • 5 Ways to Find Systems Running Domain Admin Processes - Scott Sutherland
      • Attack Methods for Gaining Domain Admin Rights in Active Directory
      • Nodal Analysis of Domain Trusts – Maximizing the Win!
      • Derivative Local Admin - sixdub
      • Abusing DNSAdmins privilege for escalation in Active Directory
      • How Attackers Dump Active Directory Database Credentials
      • “I Hunt Sys Admins”
      • Gaining Domain Admin from Outside Active Directory - markitzeroday
    • Talks/Videos
      • I Hunt Sys Admins - Will Schroeder/@harmj0y(Shmoocon 2015)
      • I Hunt Sysadmins 2.0 - slides
        • It covers various ways to hunt for users in Windows domains, including using PowerView.
      • Requiem For An Admin, Walter Legowski (@SadProcessor) - BSides Amsterdam 2017
        • Orchestrating BloodHound and Empire for Automated AD Post-Exploitation. Lateral Movement and Privilege Escalation are two of the main steps in the Active Directory attacker kill- chain. Applying the 'assume breach' mentality, more and more companies are asking for red-teaming type of assessments, and security researcher have therefor developed a wide range of open-source tools to assist them during these engagements. Out of these, two have quickly gained a solid reputation: PowerShell Empire and BloodHound (Both by @Harmj0y & ex-ATD Crew). In this Session, I will be presenting DogStrike, a new tool (PowerShell Modules) made to interface Empire & BloodHound, allowing penetration testers to merge their Empire infrastructure into the bloodhound graph database. Doing so allows the operator to request a bloodhound path that is 'Agent Aware', and makes it possible to automate the entire kill chain, from initial foothold to DA - or any desired part of an attacker's routine. Presentation will be demo-driven. Code for the module will be made public after the presentation. Automation of Active Directory post-exploitation is going to happen sooner than you might think. (Other tools are being released with the same goal). Is it a good thing? Is it a bad thing? If I do not run out of time, I would like to finish the presentation by opening the discussion with the audience and see what the consequences of automated post- exploitation could mean, from the red, the blue or any other point of view... : DeathStar by @Byt3Bl33d3r | GoFetch by @TalTheMaor.
    • Tools
      • Check-LocalAdminHash
        • Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where they are local admin on a network.
        • Blogpost
      • hunter
        • (l)user hunter using WinAPI calls only
      • icebreaker
        • Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you're inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plaintext credentials as well as hashes. Autocracks hashes found with JohnTheRipper and the top 10 million most common passwords.
      • Invoke-HostRecon
        • This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users, and domain information. It does not use any 'net', 'ipconfig', 'whoami', 'netstat', or other system commands to help avoid detection.
      • DeathStar
        • DeathStar is a Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Active Directory environments using a variety of techinques.
      • ANGRYPUPPY
        • Bloodhound Attack Path Execution for Cobalt Strike
      • GoFetch
        • GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application. GoFetch first loads a path of local admin users and computers generated by BloodHound and converts it to its own attack plan format. Once the attack plan is ready, GoFetch advances towards the destination according to plan step by step, by successively applying remote code execution techniques and compromising credentials with Mimikatz.
      • DogWhisperer - BloodHound Cypher Cheat Sheet (v2)
      • DomainTrustExplorer
        • Python script for analyis of the "Trust.csv" file generated by Veil PowerView. Provides graph based analysis and output.
  • DCShadow
    • DCShadow
      • DCShadow is a new feature in mimikatz located in the lsadump module. It simulates the behavior of a Domain Controller (using protocols like RPC used only by DC) to inject its own data, bypassing most of the common security controls and including your SIEM. It shares some similarities with the DCSync attack (already present in the lsadump module of mimikatz).
    • DCShadow explained: A technical deep dive into the latest AD attack technique - Luc Delsalle
    • What is DCShadow? - Stealthbits
    • DCShadow: Attacking Active Directory with Rogue DCs - Jeff Warren
    • Silently turn off Active Directory Auditing using DCShadow - Nikhil Mittal
    • Creating Persistence With Dcshadow
  • DCSync Attack
    • What is DCSync? An Introduction - Lee Berg
    • DCSync - Yojimbo Security
    • [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol - docs.ms
    • Abusing Active Directory Permissions with PowerView - harmj0y
    • DCSync: Dump Password Hashes from Domain Controller - ired.team
    • Mimikatz DCSync Usage, Exploitation, and Detection - Sean Metcalf
    • Mimikatz and DCSync and ExtraSids, Oh My - harmj0y
    • Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync
    • Extracting User Password Data with Mimikatz DCSync - Jeff Warren
  • Constrained-Delegation
    • Articles/Blogposts/Writeups
      • Another Word on Delegation
      • From Kekeo to Rubeus
      • S4U2Pwnage
      • Kerberos Delegation, Spns And More...
      • A Case Study in Wagging the Dog: Computer Takeover - harmj0y
      • Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory - Elad Shamir
        • Back in March 2018, I embarked on an arguably pointless crusade to prove that the TrustedToAuthForDelegation attribute was meaningless, and that “protocol transition” can be achieved without it. I believed that security wise, once constrained delegation was enabled (msDS-AllowedToDelegateTo was not null), it did not matter whether it was configured to use “Kerberos only” or “any authentication protocol”. I started the journey with Benjamin Delpy’s (@gentilkiwi) help modifying Kekeo to support a certain attack that involved invoking S4U2Proxy with a silver ticket without a PAC, and we had partial success, but the final TGS turned out to be unusable. Ever since then, I kept coming back to it, trying to solve the problem with different approaches but did not have much success. Until I finally accepted defeat, and ironically then the solution came up, along with several other interesting abuse cases and new attack techniques.
      • Kerberos Delegation, SPNs and More... - Alberto Solino(2017)
        • In this blog post, I will cover some findings (and still remaining open questions) around the Kerberos Constrained Delegation feature in Windows as well as Service Principal Name (SPN) filtering that might be useful when considering using/testing this technology.
      • The worst of both worlds: Combining NTLM Relaying and Kerberos delegation - Dirk-jan Mollema
        • After my in-depth post last month about unconstrained delegation, this post will discuss a different type of Kerberos delegation: resource-based constrained delegation. The content in this post is based on Elad Shamir’s Kerberos research and combined with my own NTLM research to present an attack that can get code execution as SYSTEM on any Windows computer in Active Directory without any credentials, if you are in the same network segment. This is another example of insecure Active Directory default abuse, and not any kind of new exploit.
      • Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation - Daniel López Jiménez and Simone Salucci
    • Talks & Presentations
      • Delegate to the Top Abusing Kerberos for Arbitrary Impersonations and RCE - Matan Hart(BHASIA 17)
  • Unconstrained Delegation
    • Articles/Blogposts/Writeups
      • Active Directory Security Risk #101: Kerberos Unconstrained Delegation (or How Compromise of a Single Server Can Compromise the Domain)
      • Unconstrained Delegation Permissions
      • Trust? Years to earn, seconds to break
      • Hunting in Active Directory: Unconstrained Delegation & Forests Trusts
      • Getting Domain Admin with Kerberos Unconstrained Delegation - Nikhil Mittal
      • Domain Controller Print Server + Unconstrained Kerberos Delegation = Pwned Active Directory Forest - adsecurity.org
      • [MS-RPRN]: Print System Remote Protocol - docs.ms
      • [MS-RPRN]: Print System Remote Protocol - msdn.ms
    • Talks & Presentations
      • The Unintended Risks of Trusting Active Directory - Lee Christensen, Will Schroeder, Matt Nel(Derbycon 2018)
        • Your crown jewels are locked in a database, the system is patched, utilizes modern endpoint security software, and permissions are carefully controlled and locked down. Once this system is joined to Active Directory, however, does that static trust model remain the same? Or has the number of attack paths to your data increased by an order of magnitude? We’ve spent the last year exploring the access control model of Active Directory and recently broadened our focus to include security descriptor misconfigurations/backdoor opportunities at the host level. We soon realized that the post-exploitation “attack surface” of Windows hosts spans well beyond what we originally realized, and that host misconfigurations can sometimes have a profound effect on the security of every other host in the forest. This talk will explore a number of lesser-known Active Directory and host-based permission settings that can be abused in concert for remote access, privilege escalation, or persistence. We will show how targeted host modifications (or existing misconfigurations) can facilitate complex Active Directory attack chains with far-reaching effects on other systems and services in the forest, and can allow new AD attack paths to be built without modifying Active Directory itself.
        • Slides
    • Tools
      • SpoolSample -> NetNTLMv1 -> NTLM -> Silver Ticket
        • This technique has been alluded to by others, but I haven't seen anything cohesive out there. Below we'll walk through the steps of obtaining NetNTLMv1 Challenge/Response authentication, cracking those to NTLM Hashes, and using that NTLM Hash to sign a Kerberos Silver ticket. This will work on networks where "LAN Manager authentication level" is set to 2 or less. This is a fairly common scenario in older, larger Windows deployments. It should not work on Windows 10 / Server 2016 or newer.
      • SpoolerScanner
        • Check if the spooler (MS-RPRN) is remotely available with powershell/c#
      • SpoolSample
        • PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.
  • Kerberoast(ing)
    • Articles/Blogposts/Writueps
      • Kerberoasting - Part 1 - mubix
      • Kerberoasting - Part 2 - mubix
      • Kerberoasting - Part 3 - mubix
      • Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain - adsecurity.org
      • Kerberoasting Without Mimikatz - Will Schroeder
      • Mimikatz 2.0 - Brute-Forcing Service Account Passwords
        • If everything about that ticket-generation operation is valid except for the NTLM hash, then accessing the web application will result in a failure. However, this will not cause a failed logon to appear in the Windows® event log. It will also not increment the count of failed logon attempts for the service account. Therefore, the result is an ability to perform brute-force (or, more realistically, dictionary-based) password checks for such a service account, without locking it out or generating suspicious event log entries.
      • kerberos, kerberoast and golden tickets - leonjza
      • Extracting Service Account Passwords with Kerberoasting - Jeff Warren
      • Cracking Service Account Passwords with Kerberoasting
      • Targeted Kerberoasting - harmj0y
      • Kerberoast PW list for cracking passwords with complexity requirements
      • kerberos, kerberoast and golden tickets - leonzja
      • Kerberoast - pentestlab.blog
      • A Toast to Kerberoast - Derek Banks
      • Kerberoasting, exploiting unpatched systems – a day in the life of a Red Teamer - Chetan Nayak
      • Discovering Service Accounts Without Using Privileges - Jeff Warren
      • Kerberoasting - Pixis
      • Kerberoasting and SharpRoast output parsing! - grumpy-sec
    • Talks & Presentations
      • Attacking Kerberos: Kicking the Guard Dog of Hades - Tim Medin
        • Kerberos, besides having three heads and guarding the gates of hell, protects services on Microsoft Windows Domains. Its use is increasing due to the growing number of attacks targeting NTLM authentication. Attacking Kerberos to access Windows resources represents the next generation of attacks on Windows authentication.In this talk Tim will discuss his research on new attacks against Kerberos- including a way to attack the credentials of a remote service without sending traffic to the service as well as rewriting tickets to access systems.He will also examine potential countermeasures against Kerberos attacks with suggestions for mitigating the most common weaknesses in Windows Kerberos deployments.
      • Demo of kerberoasting on EvilCorp Derbycon6
      • Attacking EvilCorp Anatomy of a Corporate Hack - Sean Metcalf, Will Schroeder
        • Slides
      • Kerberos & Attacks 101 - Tim Medin(SANS Webcast)
        • Want to understand how Kerberos works? Would you like to understand modern Kerberos attacks? If so, then join Tim Medin as he walks you through how to attack Kerberos with ticket attacks and Kerberoasting. Well cover the basics of Kerberos authentication and then show you how the trust model can be exploited for persistence, pivoting, and privilege escalation.
      • Kerberoasting Revisited - Will Schroeder(Derbycon2019)
        • Kerberoasting has become the red team'?'s best friend over the past several years, with various tools being built to support this technique. However, by failing to understand a fundamental detail concerning account encryption support, we haven'?'t understood the entire picture. This talk will revisit our favorite TTP, bringing a deeper understanding to how the attack works, what we?ve been missing, and what new tooling and approaches to kerberoasting exist.
    • Tools
      • kerberoast
        • Kerberoast is a series of tools for attacking MS Kerberos implementations.
      • tgscrack
        • Kerberos TGS_REP cracker written in Golang
    • AS-REP
      • Roasting AS-REPs - harmj0y
        • tl;dr – if you can enumerate any accounts in a Windows domain that don’t require Kerberos preauthentication, you can now easily request a piece of encrypted information for said accounts and efficiently crack the material offline, revealing the user’s password.
  • Pass-the-*
    • 101
    • Cache
      • Tweet by Benjamin Delpy(2014)
      • Pass-the-Cache to Domain Compromise - Jamie Shaw
        • This post is going to go over a very quick domain compromise by abusing cached Kerberos tickets discovered on a Linux-based jump-box within a Windows domain environment. In essence, we were able to steal cached credentials from a Linux host and use them on a Window-based system to escalate our privileges to domain administrator level.
    • Hash
      • For this kind of attack and related ones, check out the Network Attacks page, under Pass-the-Hash.
      • Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy - harmj0y
      • Windows Credential Guard & Mimikatz - nviso
      • Wendel's Small Hacking Tricks - The Annoying NT_STATUS_INVALID_WORKSTATION
      • Passing the hash with native RDP client (mstsc.exe)
        • TL;DR: If the remote server allows Restricted Admin login, it is possible to login via RDP by passing the hash using the native Windows RDP client mstsc.exe. (You’ll need mimikatz or something else to inject the hash into the process)
      • Invoke-TheHash
        • Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB services are accessed through .NET TCPClient connections. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.
      • Pass-The-Hash with RDP in 2019 - shellz.club
      • Pass the Hash - hackndo
      • Pass-the-Hash Web Style - SANS
    • Over-Pass-the-Hash
      • Overpass-the-hash - Benjamin Delpy
      • AD Security – Overpass-the-Hash Scenario - Eli Shlomo
    • Ticket
      • How To Pass the Ticket Through SSH Tunnels
      • Pass-the-ticket - ldapwiki
      • Silver & Golden Tickets - hackndo
      • Silver
        • Sneaky Active Directory Persistence #16: Computer Accounts & Domain Controller Silver Tickets - adsecurity
        • Impersonating Service Accounts with Silver Tickets - stealthbits
        • Mimikatz 2.0 - Silver Ticket Walkthrough
        • How Attackers Use Kerberos Silver Tickets to Exploit Systems
      • Golden
        • mimikatz - golden ticket
        • Golden Ticket - ldapwiki
        • Advanced Targeted Attack. PoC Golden Ticket Attack - BSides Tampa 17
        • Complete Domain Compromise with Golden Tickets - stealthbits
        • Pass-the-(Golden)-Ticket with WMIC
        • Kerberos Golden Tickets are Now More Golden - ADSecurity.org
        • Mimikatz 2.0 - Golden Ticket Walkthrough - Ben Lincoln
  • Shadow Admins(ACLs)
    • Shadow Admins – The Stealthy Accounts That You Should Fear The Most - Asaf Hecht
    • ACLight
      • ACLight is a tool for discovering privileged accounts through advanced ACLs analysis (objects’ ACLs - Access Lists, aka DACL\ACEs). It includes the discovery of Shadow Admins in the scanned network.
  • (NTLM)SMB Relay
    • See Network_Attacks.md
    • Redirect to SMB - Cylance SPEAR
  • Skeleton Key
    • Active Directory Domain Controller Skeleton Key Malware & Mimikatz - ADSecurity
    • Skeleton Key Malware Analysis - SecureWorks
    • Unlocking All The Doors To Active Directory With The Skeleton Key Attack
    • Skeleton Key
    • Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest
  • Specific Vulnerabilities"
    • MS14-068
      • About
        • MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege
        • MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege - adsecurity.org
        • Kerberos Vulnerability in MS14-068 (KB3011780) Explained - adsecurity.org
        • Detecting MS14-068 Kerberos Exploit Packets on the Wire aka How the PyKEK Exploit Works - adsecurity.org
        • Exploiting MS14-068 Vulnerable Domain Controllers Successfully with the Python Kerberos Exploitation Kit (PyKEK) - adsecurity.org
        • Digging into MS14-068, Exploitation and Defence - Ben Campbell, Jon Cave
      • Exploiting
        • Digging into MS14-068, Exploitation and Defence
        • From MS14-068 to Full Compromise - Stepy by Step - David Kennedy
        • Microsoft Security Bulletin MS14-068 - Critical - docs.ms
        • Exploiting MS14-068 with PyKEK and Kali - Zach Grace
        • Exploiting MS14-068 Vulnerable Domain Controllers Successfully with the Python Kerberos Exploitation Kit (PyKEK) - adsecurity.org
    • MS15-011
      • Practically Exploiting MS15-014 and MS15-011 - MWR
      • MS15-011 - Microsoft Windows Group Policy real exploitation via a SMB MiTM attack - coresecurity
• WIP
  • Defense Evasion
    • Evading Microsoft ATA for Active Directory Domination - Nikhil Mittal
      • Microsoft Advanced Threat Analytics (ATA) is a defense platform which reads information from multiple sources like traffic for certain protocols to the Domain Controller, Windows Event Logs and SIEM events. The information thus collected is used to detect Reconnaissance, Credentials replay, Lateral movement, Persistence attacks etc. Well known attacks like Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, Golden Ticket, Directory services replication, Brute-force, Skeleton key etc. can be detected using ATA.
    • [Red Team Techniques for Evading, Bypassing & Disabling MS - Chris Thompson]
      • Windows Defender Advanced Threat Protection is now available for all Blue Teams to utilize within Windows 10 Enterprise and Server 2012/16, which includes detection of post breach tools, tactics and techniques commonly used by Red Teams, as well as behavior analytics.
      • Slides
  • Collection
    • Accessing Internal Fileshares through Exchange ActiveSync - Adam Rutherford and David Chismon
  • Credential Access * Articles/Blogposts/Writeups * Remotely dump "Active Directory Domain Controller" machine user database using web shell - Indishell * Auto-Dumping Domain Credentials using SPNs, PowerShell Remoting, and Mimikatz - Scott Sutherland * How Attackers Dump Active Directory Database Credentials - adsecurity.org * Places of Interest in Stealing NetNTLM Hashes - osandamalith.com * Multi-Factor Mixup: Who Were You Again? - Okta * A weakness in the Microsoft ADFS protocol for integration with MFA products allows a second factor for one account to be used for second-factor authentication to all other accounts in an organization. * Playing with Relayed Credentials - SecureAuth * When Everyone's Dog is Named Fluffy: Abusing the Brand New Security Questions in Windows 10 to Gain Domain-Wide Persistence - Magal Baz, Tom Sela * Slides * Active Directory Enumeration with PowerShell - Haboob * Nowadays, most of the environments are using Active Directory to manage their networks and resources. And over the past years, the attackers have been focused to abuse and attack the Active Directory environments using different techniques and methodologies. So in this research paper, we are going to use the power of the PowerShell to enumerate the resources of the Active Directory, like enumerating the domains, users, groups, ACL, GPOs, domain trusts also hunting the users and the domain admins. With this valuable information, we can increase our attack surface to abuse the AD like Privilege escalation, lateral movements and persistence and so on. * Cached Credentials: Important Facts That You Cannot Miss - CQURE * Protect derived domain credentials with Windows Defender Credential Guard - docs.ms * KB2871997 and Wdigest - Part 1 - docs.ms * Clearing cached/saved Windows credentials - University of Waterloo * Cached domain logon information - support.ms * Interactive logon: Number of previous logons to cache (in case domain controller is not available) - docs.ms * Interactive logon: Number of previous logons to cache (in case domain controller is not available - UltimateWindowsSecurity * Using Domain Controller Account Passwords To HashDump Domains - Mubix * Presentations/Talks/Videos * Tools * DomainPasswordTest * Tests AD passwords while respecting Bad Password Count * serviceFu * Automates credential skimming from service accounts in Windows Registry using Mimikatz lsadump::secrets. The use case for this tool is when you have administrative rights across certain computers in a domain but do not have any clear-text credentials. ServiceFu will remotely connect to target computers, check if any credentialed services are present, download the system and security registry hive, and decrypt clear-text credentials for the domain service account. * Credential Assessment: Mapping Privilege Escalation at Scale - Matt Weeks(Hack.lu 2016) * In countless intrusions from large retail giants to oil companies, attackers have progressed from initial access to complete network compromise. In the aftermath, much ink is spilt and products are sold on how the attackers first obtained access and how the malware they used could or could not have been detected, while little attention is given to the credentials they found that turned their access on a single-system into thousands more. This process, while critical for offensive operations, is often complex, involving many links in the escalation chain composed of obtaining credentials on system A that grant access to system B and credentials later used on system B that grant further access, etc. We’ll show how to identify and combat such credential exposure at scale with the framework we developed. We comprehensively identify exposed credentials and automatically construct the compromise chains to identify maximal access and privileges gained, useful for either offensive or defensive purposes.
  • Persistence
    • The Active Directory Botnet - Ty Miller, Paul Kalinin(BHUSA 17)
    • Command and Control Using Active Directory - harmj0y
    • Sneaky Active Directory Persistence #12: Malicious Security Support Provider (SSP) - adsecurity.org
  • Privilege Escalation
    • ACEs/ACLs/DACLs
      • DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841) - Nabeel Ahmed
        • This vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in "Full Control" permissions for the low privileged user.
      • Microsoft Exchange – ACL - NetbiosX
    • Aiming for DA
      • Post-Exploitation in Windows: From Local Admin To Domain Admin (efficiently) - pentestmonkey)
      • Scenario-based pen-testing: From zero to domain admin with no missing patches required - Georgia Weidman
      • Top Five Ways I Got Domain Admin on Your Internal Network before Lunch (2018 Edition) - Adam Toscher
      • Attack Methods for Gaining Domain Admin Rights in Active Directory - adsecurity
      • Gaining Domain Admin from Outside Active Directory - markitzeroday.com
    • Group Policy
      • How to own any windows network with group policy hijacking attacks
    • One-offs
      • Gone to the Dogs - Elad Shamir
        • Win10 PrivEsc Domain Joined
      • CVE-2018-8340: Multi-Factor Mixup: Who Were You Again? - Andrew Lee
        • A weakness in the Microsoft ADFS protocol for integration with MFA products allows a second factor for one account to be used for second-factor authentication to all other accounts in an organization.
  • MS CVE-2018-8340
    • Tools
      • ADAPE-Script
        • Active Directory Assessment and Privilege Escalation Script
  • Reconaissance
    • Articles/Blogposts/Presentations/Talks/Writeups
      • Active Directory Firewall Ports – Let’s Try To Make This Simple - Ace Fekay(2011)
      • Automating the Empire with the Death Star: getting Domain Admin with a push of a button
      • Active Directory Pentest Recon Part 1: SPN Scanning aka Mining Kerberos Service Principal Names
      • Active Directory Recon Without Admin Rights - adsecurity
      • Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode - Nikhil Mittal
      • Kerberos Domain Username Enumeration - matt
      • adcli info - Fedora documentation
      • adcli info forest - Fedora documentation
      • AD Zone Transfers as a user - mubix
      • Gathering AD Data with the Active Directory PowerShell Module - ADSecurity.com
      • Enumerating remote access policies through GPO - William Knowles, Jon Cave
    • Tools
      • BloodHound
        • 101
          • Introducing BloodHound
          • Bloodhound 2.2 - A Tool for Many Tradecrafts - Andy Gill
        • BloodHound
          • BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a PowerShell ingestor. BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.
        • Articles/Blogposts/Writeups
          • BloodHound and the Adversary Resilience Model
          • Introducing the Adversary Resilience Methodology — Part One - Andy Robbins
          • Introducing the Adversary Resilience Methodology — Part Two - Andy Robbins
        • Historical Posts
          • Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. - JohnLaTwC
          • Automated Derivative Administrator Search - wald0
          • BloodHound 1.3 – The ACL Attack Path Update - wald0
          • BloodHound 1.4: The Object Properties Update - CptJesus
          • SharpHound: Target Selection and API Usage
          • BloodHound 1.5: The Container Update
          • A Red Teamer’s Guide to GPOs and OUs - wald0
          • BloodHound 2.0 - CptJesus
          • BloodHound 2.1: The Fix Broken Stuff Update - Rohan Vazarkar
        • Using
          • BloodHound: Intro to Cypher - CptJesus
          • The Dog Whisperer's Handbook: A Hacker's Guide to the BloodHound Galaxy - @SadProcessor
            • Blogpost
          • My First Go with BloodHound
          • Lay of the Land with BloodHound
          • Bloodhound walkthrough. A Tool for Many Tradecrafts - Andy Gill
            • A walkthrough on how to set up and use BloodHound
          • BloodHound From Red to Blue - Mathieu Saulnier(BSides Charm2019)
          • BloodHound Tips and Tricks - Riccardo Ancarani
        • Neo4j
          • Neo4j Cypher Refcard 3.5
        • Extending Functionality
          • Visualizing BloodHound Data with PowerBI — Part 1 - Andy Robbins
          • Visualizing BloodHound Data with PowerBI — Part 2 - Andy Robbins
          • Extending BloodHound: Track and Visualize Your Compromise
            • Customizing BloodHound's UI and taking advantage of Custom Queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains.
          • Extending BloodHound Part 1 - GPOs and User Right Assignment - Riccardo Ancarani
          • Cypheroth
            • Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.
        • Ingestors
          • BloodHound.py
            • A Python based ingestor for BloodHound
        • API
          • CypherDog
            • PowerShell Cmdlets to interact with BloodHound Data via Neo4j REST API
      • Domain Reconaissance
        • PowerView.ps1
        • PywerView
          • A (partial) Python rewriting of PowerSploit's PowerView.
        • The PowerView PowerUsage Series #1 - harmjoy
          • Part #2
          • Part #3
          • Part #4
          • Part #5
        • goddi
          • goddi (go dump domain info) dumps Active Directory domain information
        • ADRecon
          • ADRecon is a tool which extracts and combines various artefacts (as highlighted below) out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis and provide a holistic picture of the current state of the target AD environment. The tool is useful to various classes of security professionals like auditors, DFIR, students, administrators, etc. It can also be an invaluable post-exploitation tool for a penetration tester. It can be run from any workstation that is connected to the environment, even hosts that are not domain members. Furthermore, the tool can be executed in the context of a non-privileged (i.e. standard domain user) account. Fine Grained Password Policy, LAPS and BitLocker may require Privileged user accounts. The tool will use Microsoft Remote Server Administration Tools (RSAT) if available, otherwise it will communicate with the Domain Controller using LDAP.
        • AdEnumerator
          • Active Directory enumeration from non-domain system. Powershell script
        • Orchard
          • Live off the land for macOS. This program allows users to do Active Directory enumeration via macOS' JXA (JavaScript for Automation) code. This is the newest version of AppleScript, and thus has very poor documentation on the web.
        • PowerShell-AD-Recon
          • AD PowerShell Recon Scripts
        • ADCollector
          • A lightweight tool that enumerates the Active Directory environment to identify possible attack vectors
        • AdsiPS
          • PowerShell module to interact with Active Directory using ADSI and the System.DirectoryServices namespace (.NET Framework).
        • jackdaw
          • Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy feature to help you in a password-cracking project by storing/looking up/reporting hashes/passowrds/users.
      • Local Machine
        • HostEnum
          • A PowerShell v2.0 compatible script comprised of multiple system enumeration / situational awareness techniques collected over time. If system is a member of a Windows domain, it can also perform limited domain enumeration with the -Domain switch. However, domain enumeration is significantly limited with the intention that PowerView or BoodHound could also be used.
      • Passwords
        • NtdsAudit
          • NtdsAudit is an application to assist in auditing Active Directory databases. It provides some useful statistics relating to accounts and passwords. It can also be used to dump password hashes for later cracking.
      • Service Principal Name(SPN) Scanning
        • Service Principal Names - docs.ms
        • SPNs - adsecurity.org
          • This page is a comprehensive reference (as comprehensive as possible) for Active Directory Service Principal Names (SPNs). As I discover more SPNs, they will be added.
        • Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe - social.technet.ms.com)
        • SPN Discovery - pentestlab.blog
        • Discovering Service Accounts Without Using Privileges - Jeff Warren
    • Miscellaneous Tools
      • ActiveReign
        • A Network Enumeration and Attack Toolset
      • CrackMapExec
        • A swiss army knife for pentesting networks
      • Windows Vault Password Dumper
        • The following code shows how to use native undocumented functions of Windows Vault API to enumerate and extract credentials stored by Microsoft Windows Vault. The code has been successfully tested on Windows7 and Windows8 operating systems.
      • knit_brute.sh
        • A quick tool to bruteforce an AD user's password by requesting TGTs from the Domain Controller with 'kinit'
      • BTA
        • BTA is an open-source Active Directory security a5udit framework.
      • WinPwn
        • Automation for internal Windows Penetrationtest / AD-Security
      • Check-LocalAdminHash & Exfiltrating All PowerShell History - Beau Bullock
        • Check-LocalAdminHash is a new PowerShell script that can check a password hash against multiple hosts to determine if it’s a valid administrative credential. It also has the ability to exfiltrate all PowerShell PSReadline console history files from every profile on every system that the credential provided is an administrator of.
      • Check-LocalAdminHash
        • Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where they are local admin on a network. It is essentially a Frankenstein of two of my favorite tools along with some of my own code. It utilizes Kevin Robertson's (@kevin_robertson) Invoke-TheHash project for the credential checking portion. Additionally, the script utilizes modules from PowerView by Will Schroeder (@harmj0y) and Matt Graeber (@mattifestation) to enumerate domain computers to find targets for testing admin access against.
      • Wireless_Query
        • Query Active Directory for Workstations and then Pull their Wireless Network Passwords. This tool is designed to pull a list of machines from AD and then use psexec to pull their wireless network passwords. This should be run with either a DOMAIN or WORKSTATION Admin account.
      • Find AD users with empty password using PowerShell
      • ACLight
        • The tool queries the Active Directory (AD) for its objects' ACLs and then filters and analyzes the sensitive permissions of each one. The result is a list of domain privileged accounts in the network (from the advanced ACLs perspective of the AD). You can run the scan with just any regular user (could be non-privileged user) and it automatically scans all the domains of the scanned network forest.
      • zBang
        • zBang is a special risk assessment tool that detects potential privileged account threats in the scanned network.
        • Blogpost

---

Email/Microsoft Exchange

• Look at the phishing page
  • Link to the Phishing page - Markdown
  • Link to the Phishing page - HTML
• Articles/Blogposts/Writeups
  • Microsoft Exchange – Password Spraying - pentestlab.blog
  • Microsoft Exchange – Domain Escalation - pentestlab.blog
  • Microsoft Exchange – Mailbox Post Compromise - NetbiosX
• Privilege Escalation (ab)using
  • Abusing Exchange: One API call away from Domain Admin - dirkjanm.io
  • Red Teaming Made Easy with Exchange Privilege Escalation and PowerPriv - RedXORBlue
• Tools
  • Exchange-AD-Privesc
    • This repository provides a few techniques and scripts regarding the impact of Microsoft Exchange deployment on Active Directory security. This is a side project of AD-Control-Paths, an AD permissions auditing project to which I recently added some Exchange-related modules.
  • Abusing Exchange: One API call away from Domain Admin - Dirk-jan Mollema
  • Exploiting PrivExchange - chryzsh
    • expansion and demo of how to use the PrivExchange exploit
  • MailSniper
    • MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain. MailSniper also includes additional modules for password spraying, enumerating users/domains, gathering the Global Address List from OWA and EWS, and checking mailbox permissions for every Exchange user at an organization.
  • PowerPriv
    • A powershell implementation of PrivExchange by @_dirkjan (original code found here: https://github.com/dirkjanm/PrivExchange/blob/master/privexchange.py) Useful for environments on which you cannot run python-based applications, have user credentials, or do not want to drop files to disk. Will cause the target exchange server system account to attempt to authenticate to a system of your choice.
  • exchange_hunter2
    • This script uses a valid credential, a DC IP and Hostname to log into the DC over LDAP and query the LDAP server for the wherabouts of the Microsoft Exchange servers in the environment.

---

Pivoting

• Pivoting
  • Articles/Writeups
    • A Red Teamer's guide to pivoting
    • Pivoting into a network using PLINK and FPipe
    • Pillage the Village Redux w/ Ed Skoudis & John Strand - SANS
    • Browser Pivot for Chrome - cplsec
    • Browser Pivoting (Get past two-factor auth) - blog.cobalstrike
    • Windows Domains, Pivot & Profit - Fuzzynop
      • Hola! In this write-up we will be looking at different ways to move laterally when compromising a Windows domain. This post is by no means exhaustive but it should cover some of the more basic techniques and thought processes.
    • Bash
      • More on Using Bash's Built-in /dev/tcp File (TCP/IP)
    • Metasploit
      • Portfwd - Pivot from within meterpreter
      • Reverse SSL backdoor with socat and metasploit (and proxies)
    • SSH
      • Pivoting Ssh Reverse Tunnel Gateway
      • SSH Gymnastics and Tunneling with ProxyChains
      • SSH Cheat Sheet - pentestmonkey
      • proxychains-ng
        • proxychains ng (new generation) - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project. the sf.net page is currently not updated, use releases from github release page instead.
      • Using sshuttle in daily work - Huiming Teo
    • VPN
      • How VPN Pivoting Works (with Source Code) - cs
      • Universal TUN/TAP device driver. - kernel.org
      • Tun/Tap interface tutorial - backreference
      • Responder and Layer 2 Pivots - cplsec
      • simpletun
        • Example program for tap driver VPN
    • WMIC
      • The Grammar of WMIC
  • Tools
    • Socat
      • socat is a relay for bidirectional data transfer between two independent data channels. Each of these data channels may be a file, pipe, device (serial line etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 - raw, UDP, TCP), an SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU line editor (readline), a program, or a combination of two of these. These modes include generation of "listening" sockets, named pipes, and pseudo terminals.
      • Examples of use
      • Socat Cheatsheet
    • Discovery
      • nextnet
        • nextnet is a pivot point discovery tool written in Go.
    • DNS
      • ThunderDNS: How it works - fbkcs.ru
    • HTTP/HTTPS
      • SharpSocks
        • Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell
      • Chisel
        • Chisel is a fast TCP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang). Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network.
      • Crowbar
        • Crowbar is an EXPERIMENTAL tool that allows you to establish a secure circuit with your existing encrypting TCP endpoints (an OpenVPN setup, an SSH server for forwarding...) when your network connection is limited by a Web proxy that only allows basic port 80 HTTP connectivity. Crowbar will tunnel TCP connections over an HTTP session using only GET and POST requests. This is in contrast to most tunneling systems that reuse the CONNECT verb. It also provides basic authentication to make sure nobody who stumbles upon the server steals your proxy to order drugs from Silkroad.
      • A Black Path Toward The Sun(ABPTTS)
        • ABPTTS uses a Python client script and a web application server page/package[1] to tunnel TCP traffic over an HTTP/HTTPS connection to a web application server. In other words, anywhere that one could deploy a web shell, one should now be able to establish a full TCP tunnel. This permits making RDP, interactive SSH, Meterpreter, and other connections through the web application server.
    • SMB
      • Piper
        • Creates a local or remote port forwarding through named pipes.
      • flatpipes
        • A TCP proxy over named pipes. Originally created for maintaining a meterpreter session over 445 for less network alarms.
      • Invoke-PipeShell
        • This script demonstrates a remote command shell running over an SMB Named Pipe. The shell is interactive PowerShell or single PowerShell commands
      • Invoke-Piper
        • Forward local or remote tcp ports through SMB pipes.
    • PowerShell
      • PowerShellDSCLateralMovement.ps1
    • SSH
      • SSHDog
        • SSHDog is your go-anywhere lightweight SSH server. Written in Go, it aims to be a portable SSH server that you can drop on a system and use for remote access without any additional configuration.
      • MeterSSH
        • MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH connection. The way it works is by injecting shellcode into memory, then wrapping a port spawned (meterpeter in this case) by the shellcode over SSH back to the attackers machine. Then connecting with meterpreter's listener to localhost will communicate through the SSH proxy, to the victim through the SSH tunnel. All communications are relayed through the SSH tunnel and not through the network.
    • Sockets/TCP/UDP
      • SOCKS: A protocol for TCP proxy across firewalls
      • shootback
        • shootback is a reverse TCP tunnel let you access target behind NAT or firewall
      • ssf - Secure Socket Funneling
        • Network tool and toolkit. It provides simple and efficient ways to forward data from multiple sockets (TCP or UDP) through a single secure TLS tunnel to a remote computer. SSF is cross platform (Windows, Linux, OSX) and comes as standalone executables.
      • PowerCat
        • A PowerShell TCP/IP swiss army knife that works with Netcat & Ncat
      • Udp2raw-tunnel
        • A Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket, helps you Bypass UDP FireWalls(or Unstable UDP Environment). Its Encrypted, Anti-Replay and Multiplexed. It also acts as a Connection Stabilizer.)
      • reGeorg
        • The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.
      • redsocks – transparent TCP-to-proxy redirector
        • This tool allows you to redirect any TCP connection to SOCKS or HTTPS proxy using your firewall, so redirection may be system-wide or network-wide.
      • Tunna
        • Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments.
    • WMI
    • VNC
      • Invoke-Vnc
        • Invoke-Vnc executes a VNC agent in-memory and initiates a reverse connection, or binds to a specified port. Password authentication is supported.
      • jsmpeg-vnc
        • A low latency, high framerate screen sharing server for Windows and client for browsers

---

Avoiding/Bypassing AV(Anti-Virus)/UAC/Whitelisting/Sandboxes/Logging/etc

• 101
  • Noob 101: Practical Techniques for AV Bypass - Jared Hoffman - ANYCON 2017
    • The shortcomings of anti-virus (AV) solutions have been well known for some time. Nevertheless, both public and private organizations continue to rely on AV software as a critical component of their information security programs, acting as a key protection mechanism over endpoints and other information systems within their networks. As a result, the security posture of these organizations is significantly jeopardized by relying only on this weakened control.
• Educational
  • Bypass Antivirus Dynamic Analysis: Limitations of the AV model and how to exploit them - Emeric Nasi(2014)
  • Learn how to hide your trojans, backdoors, etc from anti virus.
  • Easy Ways To Bypass Anti-Virus Systems - Attila Marosi -Trooper14
  • Muts Bypassing AV in Vista/Pissing all over your AV
    • presentation, listed here as it was a bitch finding a live copy
  • How to Bypass Anti-Virus to Run Mimikatz - Spoiler, AV still suck, changing strings is helpful
  • AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It - labofapenetrationtester
  • WinPwnage
    • The goal of this repo is to study the Windows penetration techniques.
  • Art of Anti Detection 1 – Introduction to AV & Detection Techniques - Ege Balci
  • Art of Anti Detection 2 – PE Backdoor Manufacturing - Ege Balci
  • Art of Anti Detection 3 – Shellcode Alchemy - Ege Balci
  • Art of Anti Detection 4 – Self-Defense - Ege Balci
  • Breaking Antivirus Software - Joxean Koret, COSEINC(SYSCAN2014)
  • Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology - Matt Graeber
    • My goal for this blog post is to not only describe the mechanics of this new feature, but more importantly, I wanted to use this opportunity to paint a picture of the methodology I applied to understand and attempt to bypass the feature. So, if you’re already interested in WDAC features, great. If you’re not, that’s also cool but I hope you’ll follow along with the specific strategies I took to understand an undocumented Windows feature.
  • Enneos
    • Evolutionary Neural Network Encoder of Shenanigans. Obfuscating shellcode with an encoder that uses genetic algorithms to evolve neural networks to contain and output the shellcode on demand.
  • Evasion & Obfuscation Techniques - z3roTrust
  • Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology - Lee Christensen, Matt Graeber(BHUSA2018)
    • While security products are a great supplement to the defensive posture of an enterprise, to well-funded nation-state actors, they are an impediment to achieving their objectives. As pentesters argue the efficacy of a product because it doesn't detect their specific offensive technique, mature actors recognize a need to holistically subvert the product at every step during the course their operation.
    • Whitepaper
    • Slides
    • Code
• Articles/Blogposts/Writeups
  • Distribution of malicious JAR appended to MSI files signed by third parties
  • Bypass Cylance Memory Exploitation Defense & Script Cntrl
  • Three Simple Disguises for Evading Antivirus - BHIS
  • AVLeak: Fingerprinting Antivirus Emulators Through Black-Box Testing
  • How to Accidently Win Against AV - RastaMouse
  • Learn how to hide your trojans, backdoors, etc from anti virus.
  • [Virus] Self-modifying code-short overview for beginners
  • Escaping The Avast Sandbox Using A Single IOCTL
  • AVLeak: Fingerprinting Antivirus Emulators Through Black-Box Testing
  • Antivirus Evasion for Penetration Testing Engagements - Nathu Nandwani(2018)
  • Bypassing Kaspersky Endpoint Security 11 - 0xc0ffee.io
  • Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus - n00py
  • Simple AV Evasion Symantec and P4wnP1 USB - Frans Hendrik Botes
  • How to Bypass Anti-Virus to Run Mimikatz - Carrie Roberts(2017)
  • DeepSec 2013 Talk: Easy Ways To Bypass Anti-Virus Systems - Attila Marosi
  • Bypassing CrowdStrike in an enterprise production network [in 3 different ways] - KomodoResearch(2019-June)
  • Incapacitating Windows Defender - offensiveops.io
  • Endpoint Protection, Detection and Response Bypass Techniques Index - p3zx.blogspot
  • Tradecraft - This is why your tools and exploits get detected by EDR - Xentropy
  • Silencing Cylance: A Case Study in Modern EDRs - Adam Chester, Dominic Chell
  • Bypassing Detection for a Reverse Meterpreter Shell - Mohit Suyal(2018)
• Talks & Presentations
  • Adventures in Asymmetric Warfare by Will Schroeder
    • As a co-founder and principal developer of the Veil-Framework, the speaker has spent a considerable amount of time over the past year and a half researching AV-evasion techniques. This talk will briefly cover the problem space of antivirus detection, as well as the reaction to the initial release of Veil-Evasion, a tool for generating AV-evading executables that implements much of the speaker’s research. We will trace through the evolution of the obfuscation techniques utilized by Veil-Evasion’s generation methods, culminating in the release of an entirely new payload language class, as well as the release of a new ..NET encryptor. The talk will conclude with some basic static analysis of several Veil-Evasion payload families, showing once and for all that antivirus static signature detection is dead.
  • EDR, ETDR, Next Gen AV is all the rage, so why am I enraged? - Michael Gough - Derbycon7
    • A funny thing happened when I evaluated several EDR, ETDR and Next Gen AV products, currently all the rage and latest must have security solution. Surprisingly to me the solutions kinda sucked at things we expected them to do or be better at, thus this talk so you can learn from our efforts. While testing, flaws were discovered and shared with the vendors, some of the flaws, bugs, or vulns that were discovered will be discussed. This talk takes a look at what we initially expected the solutions to provide us, the options or categories of what these solutions address, what to consider when doing an evaluation, how to go about testing these solutions, how they would fit into our process, and what we found while testing these solutions. What enraged me about these EDR solutions were how they were all over the place in how they worked, how hard or ease of use of the solutions, and the fact I found malware that did not trigger an alert on every solution I tested. And this is the next new bright and shiny blinky security savior solution? The news is not all bad, there is hope if you do some work to understand what these solutions target and provide, what to look for, and most importantly how to test them! What we never anticipated or expected is the tool we used to compare the tests and how well it worked and how it can help you.
  • Next Gen AV vs My Shitty Code by James Williams - SteelCon 2018
  • Modern Evasion Techniques - Jason Lang(Derbycon7 2017)
    • As pentesters, we are often in need of working around security controls. In this talk, we will reveal ways that we bypass in-line network defenses, spam filters (in line and cloud based), as well as current endpoint solutions. Some techniques are old, some are new, but all work in helping to get a foothold established. Defenders: might want to come to this one.
    • Slides
  • Tricking modern endpoint security products - Michel Coene(SANS2020)
    • The current endpoint monitoring capabilities we have available to us are unprecedented. Many tools and our self/community-built detection rules rely on parent-child relationships and command-line arguments to detect malicious activity taking place on a system. There are, however, ways the adversaries can get around these detections. During this presentation, we'll talk about the following techniques and how we can detect them: Parent-child relationships spoofing; Command-line arguments spoofing; Process injection; Process hollowing
• Techniques
  • Code Injection
  • Debuggers
    • Batch, attach and patch: using windbg’s local kernel debugger to execute code in windows kernel
      • In this article I am going to describe a way to execute code in windows kernel by using windbg local kernel debugging. It’s not a vulnerability, I am going to use only windbg’s legal functionality, and I am going to use only a batch file (not powershell, or vbs, an old style batch only) and some Microsoft’s signed executables (some of them that are already in the system and windbg, that we will be dumped from the batch file). With this method it is not necessary to launch executables at user mode (only Microsoft signed executables) or load signed drivers. PatchGuard and other protections don’t stop us. We put our code directly into kernel memory space and we hook some point to get a thread executing it. As we will demonstrate, a malware consisting of a simple batch file would be able to jump to kernel, enabling local kernel debugging and using windbg to get its code being executed in kernel.
  • Loading-after-execution
    • Tools
      • foolavc
        • This project is foolav continuation. Original foolav was offered only as x86 executable, used single encoding for externally kept payload file. Once foolav is executed, payload is loaded into memory and executed as a shellcode in separate thread. foolavc on the other hand supports both x86 and x86_64 architectures, allows use of both internal (built-in) or external payloads. Those can be interpreted in one of three ways: shellcode, DLL and EXEcutable.
      • MemoryModule
        • MemoryModule is a library that can be used to load a DLL completely from memory - without storing on the disk first.
  • Native Binaries/Functionality
    • Research on CMSTP.exe
      • Methods to bypass UAC and load a DLL over webdav
    • rundll32 lockdown testing goodness
    • Hack Microsoft Using Microsoft Signed Binaries - Pierre-Alexandre Braeken
    • Hack Microsoft Using Microsoft Signed Binaries - BH17 - pierre - alexandre braeken
      • Imagine being attacked by legitimate software tools that cannot be detected by usual defender tools. How bad could it be to be attacked by malicious threat actors only sending bytes to be read and bytes to be written in order to achieve advanced attacks? The most dangerous threat is the one you can’t see. At a time when it is not obvious to detect memory attacks using API like VirtualAlloc, what would be worse than having to detect something like f0xffffe0010c79ebe8+0x8 L4 0xe8 0xcb 0x04 0x10? We will be able to demonstrate that we can achieve every kind of attacks you can imagine using only PowerShell and a Microsoft Signed Debugger. We can retrieve passwords from the userland memory, execute shellcode by dynamically parsing loaded PE or attack the kernel achieving advanced persistence inside any system.
    • RogueMMC
      • Execute Shellcode And Other Goodies From MMC
• Anti-Virus
  • Articles/Writeups
    • Untangling the “Windows Defender” Naming Mess - Lenny Zeltser
    • pecloak.py - An Experiment in AV evasion
    • How to Bypass Anti-Virus to Run Mimikatz
    • Practical Anti-virus Evasion - Daniel Sauder
    • Why Anti-Virus Software Fails
    • Sacred Cash Cow Tipping 2017 - BlackHills Infosec
      • We're going to bypass most of the major antivirus programs. Why? 1) Because it's fun. 2) Because it'll highlight some of the inherent weaknesses in our environments today.
    • Sacred Cash Cow Tipping 2020 - BHIS
    • Deep Dive Into Stageless Meterpreter Payloads
    • Execute ShellCode Using Python
      • In this article I am going to show you, how can we use python and its "ctypes" library to execute a "calc.exe" shell code or any other shell code.
    • Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus - noopy.io
    • Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus (Part 2) - noopy.io
    • Bypassing Kaspersky 2017 AV by XOR encoding known malware with a twist - monoc.com
    • Bypassing Static Antivirus With Ten Lines of Code - Attactics
  • Bypassing
    • OS X
      • AV
        • Bypassing antivirus on OSX 10.11 with Metasploit – Avast - astr0baby
      • Whitelisting
        • Bypassing Google's Santa Application Whitelisting on macOS (Part 1 of 2) - Adam Crosser
        • Bypassing Google's Santa Application Whitelisting on macOS (Part 2 of 2) - Adam Crosser
    • Windows
      • Defender
        • Articles/Blogposts/Writeups
          • Bypass Windows Defender Attack Surface Reduction - Emeric Nasi
          • Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology - Matt Graeber
          • Reverse Engineering Windows Defender’s JavaScript Engine - Alexei Bulazel(REcon Brussels18)
            • Defcon Videos
            • Blackhat2018 Slides
            • Tools
          • Bypassing AV (Windows Defender) … the tedious way. - CB Hue
          • Dear Windows Defender, please tell me where I can drop my malicious code. - Simone Aonzo
            • 'The Get-MpPreference cmdlet exposes the field ExclusionPath without administrator privilege.'
        • Tools
          • Windows Defender Emulator Tools
            • Tools for instrumenting Windows Defender's mpengine.dll
            • Slides
            • Video
          • ExpandDefenderSig.ps1
            • Decompresses Windows Defender AV signatures for exploration purposes
      • Microsoft ATA & ATP
        • Red Team Techniques for Evading, Bypassing, and Disabling MS Advanced Threat Protection and Advanced Threat Analytics
        • Red Team Revenge - Attacking Microsoft ATA
        • Evading Microsoft ATA for Active Directory Domination
        • Week of Evading Microsoft ATA - Announcement and Day 1 - Nikhil Mittal(Aug 2017)
        • Week of Evading Microsoft ATA - Day 2 - Overpass-the-hash and Golden Ticket - Nikhil Mittal
        • Week of Evading Microsoft ATA - Day 3 - Constrained Delegation, Attacks across trusts, DCSync and DNSAdmins - Nikhil Mittal
        • Week of Evading Microsoft ATA - Day 4 - Silver ticket, Kerberoast and SQL Servers - Nikhil Mittal
        • Week of Evading Microsoft ATA - Day 5 - Attacking ATA, Closing thoughts and Microsoft's response - Nikhil MIttal
        • Evading Microsoft ATA for Active Directory Domination - Nikhil Mittal(BH USA17)
          • Slides
        • BruCON 0x09 Talk
        • Microsoft Advanced Threat Analytics – My best practices - Oddvar Moe
        • Evading WinDefender ATP credential-theft: kernel version - B4rtik
      • Articles/Blogposts/Writeups
        • In-Memory Managed Dll Loading With PowerShell - 2012
        • Customising Meterpreter Loader DLL part. 2
        • Execute ShellCode Using Python
          • In this article I am going to show you, how can we use python and its "ctypes" library to execute a "calc.exe" shell code or any other shell code.
        • Generic bypass of next-gen intrusion / threat / breach detection systems
          • The focus of this blog post is to bypass network monitoring tools, e.g. good-old IDS or next-generation threat detection systems in a generic way. The focus is on the exploit delivery.
        • Meterpreter stage AV/IDS evasion with powershell
        • Facts and myths about antivirus evasion with Metasploit - mihi - 2011
          • This article tries to given an overview about the current executable generation scheme of Metasploit, how AV detects them, and how to evade them. Note that this document only covers standalone EXE files (for Windows) that replace an EXE template's functionality, and not other payloads for exploits, service executables (like for the windows/psexec exploit) or executables that merely add to the original template's functionality (like the -k option of msfpayload).
        • Hiding Metasploit Shellcode to Evade Windows Defender - Rapid7
      • Whitelisting
        • Escaping the Microsoft Office Sandbox: a faulty regex, allows malicious code to escape and persist - Adam Chester
        • Fantastic Red-Team Attacks and How to Find Them - Casey Smith, Ross Wolf(BHUSA 2019)
          • This talk summarizes prevalent and ongoing gaps across organizations uncovered by testing their defenses against a broad spectrum of attacks via Atomic Red Team. Many of these adversary behaviors are not atomic, but span multiple events in an event stream that may be arbitrarily and inconsistently separated in time by nuisance events.
          • Slides
        • Microsoft Applications and Blocklist - FortyNorthSecurity
        • Technical Advisory: Bypassing Workflows Protection Mechanisms - Remote Code Execution on SharePoint - Soroush Dalilil
        • Bypassing Application Whitelisting with BGInfo - Oddvar Moe
  • Sandbox Detection
    • CheckPlease
  • Tools
    • avepoc
      • some pocs for antivirus evasion
    • AVSignSeek
      • Tool written in python3 to determine where the AV signature is located in a binary/payload
    • SpookFlare: Stay In Shadows
      • SpookFlare - Github
    • avet framework
      • AVET is an AntiVirus Evasion Tool, which was developed for making life easier for pentesters and for experimenting with antivirus evasion techniques. In version 1.1 lot of stuff was introduced, for a complete overview have a look at the CHANGELOG file. Now 64bit payloads can also be used, for easier usage I hacked a small build tool (avet_fabric.py).
    • Don't Kill My Cat (DKMC)
      • Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. The idea is to avoid sandbox analysis since it's a simple "legit" image. For now the tool rely on PowerShell the execute the final shellcode payload.
      • Presentation - Northsec2017
    • Dr0p1t-Framework
      • Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks ( Trust me :D ) ;)
    • PowerLine
      • Presentation
    • Invoke-CradleCrafter: Moar PowerShell obFUsk8tion by Daniel Bohannon
    • Invoke-CradleCrafter v1.1
    • wePWNise
      • WePWNise generates architecture independent VBA code to be used in Office documents or templates and automates bypassing application control and exploit mitigation software
    • katz.xml
      • Downloads Mimikatz From GitHub, Executes Inside of MsBuild.exe
    • Shellter
    • SigThief
      • Stealing Signatures and Making One Invalid Signature at a Time
    • SideStep
      • SideStep is yet another tool to bypass anti-virus software. The tool generates Metasploit payloads encrypted using the CryptoPP library (license included), and uses several other techniques to evade AV.
    • peCloak.py - An Experiment in AV Evasion
    • Making FinFisher Undetectable
    • Bypass AV through several basic/effective techniques
    • stupid_malware
      • Python malware for pentesters that bypasses most antivirus (signature and heuristics) and IPS using sheer stupidity
    • InfectPE
      • Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files.
    • MorphAES
      • IDPS & SandBox & AntiVirus STEALTH KILLER. MorphAES is the world's first polymorphic shellcode engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it's cross-platform as well and library-independent.
    • Inception
      • Provides In-memory compilation and reflective loading of C# apps for AV evasion.
    • recomposer
      • Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.
    • Phantom-Evasion
      • Phantom-Evasion is an interactive antivirus evasion tool written in python capable to generate (almost) FUD executable even with the most common 32 bit msfvenom payload (lower detection ratio with 64 bit payloads). The aim of this tool is to make antivirus evasion an easy task for pentesters through the use of modules focused on polymorphic code and antivirus sandbox detection techniques. Since version 1.0 Phantom-Evasion also include a post-exploitation section dedicated to persistence and auxiliary modules.
• Application Whitelisting
  • 101
    • Whitelist Evasion revisited
    • Shackles, Shims, and Shivs - Understanding Bypass Techniques
    • $@|sh – Or: Getting a shell environment from Runtime.exec
    • WSH Injection: A Case Study - enigma0x3
  • Bypasses
    • Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner - exploit-monday.com
    • Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
    • How to Evade Application Whitelisting Using REGSVR32 - Joff Thyer
    • Bypassing Application Whitelisting with runscripthelper.exe - Matt Graeber
    • Using Application Compatibility Shims - subTee
    • Consider Application Whitelisting with Device Guard - subTee
    • Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations - subTee
    • Setting Up A Homestead In the Enterprise with JavaScript - subTee
    • Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
    • Application Whitelist Bypass Techniques
      • A Catalog of Application Whitelisting Bypass Techniques - SubTee
    • Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
    • MS Signed mimikatz in just 3 steps
    • BinariesThatDoesOtherStuff.txt - api0cradle
    • GreatSCT
      • The project is called Great SCT (Great Scott). Great SCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team.
    • RunMe.c
      • Trick to run arbitrary command when code execution policy is enforced (i.e. AppLocker or equivalent). Works on Win98 (lol) and up - tested on 7/8
    • Window Signed Binary
    • VBA RunPE - Breaking Out of Highly Constrained Desktop Environments - Part 1/2 - itm4n
      • Part 2
    • VBA-RunPE
      • A VBA implementation of the RunPE technique or how to bypass application whitelisting.
  • Talks
    • Modern Evasion Techniques Jason Lang - Derbycon7
    • Whitelisting Evasion - subTee - Shmoocon 2015
  • Applocker
    • Ultimate AppLocker ByPass List
      • "The goal of this repository is to document the most common and known techniques to bypass AppLocker. Since AppLocker can be configured in different ways I maintain a verified list of bypasses (that works against the default AppLocker rules) and a list with possible bypass technique (depending on configuration) or claimed to be a bypass by someone. I also have a list of generic bypass techniques as well as a legacy list of methods to execute through DLLs."
    • AppLocker Bypass Checklist - netbiosX
    • AppLocker Case study: How insecure is it really? Part 1 oddvar.moe
    • AppLocker Case study: How insecure is it really? Part 2](https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/)
    • Backdoor-Minimalist.sct
      • Applocker bypass
    • AppLocker Bypass – Weak Path Rules
    • Applocker Bypass via Registry Key Manipulation
    • Bypassing AppLocker Custom Rules - 0x09AL Security Blog
    • AppLocker Bypass – CMSTP - netbiosX
    • Bypassing AppLocker Custom Rules
    • A small discovery about AppLocker - oddvar.moe
      • 'While I was prepping for a session a while back I made a a little special discovery about AppLocker. Turns out that the files that AppLocker uses under C:\Windows\System32\AppLocker can be used in many cases to bypass a Default AppLocker ruleset.'
    • Applocker Bypass via Registry Key Manipulation - Francesco Mifsud
    • Bypassing AppLocker Custom Rules - 0x09AL
  • myAPPLockerBypassSummary
    • Simple APPLocker bypass summary based on the extensive work of @api0cradle
• AMSI
  • 101
    • AMSI Bypass - Paul Laine
    • Exploring PowerShell AMSI and Logging Evasion - Adam Chester
    • AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It - Blogpost
    • AMSI: How Windows 10 Plans to Stop Script-Based Attaacks and How Well It Does It - BH US16
  • AMSI Internals
    • The Rise and Fall of AMSI - Tal Liberman(BHAsia 2018)
    • IAmsiStream interface sample - MS Github
      • Demonstrates how to use the Antimalware Scan Interface to scan a stream.
    • Antimalware Scan Interface (AMSI) - docs.ms
    • Developer audience, and sample code - docs.ms
    • Antimalware Scan Interface (AMSI) functions - docs.ms
    • MS Office file format sorcery - Stan Hegt, Pieter Ceelen(Troopers19)
      • Slides
      • A deep dive into file formats used in MS Office and how we can leverage these for offensive purposes. We will show how to fully weaponize ‘p-code’ across all MS Office versions in order to create malicious documents without using VBA code, successfully bypassing antivirus and other defensive measures. In this talk Stan and Pieter will do a deep dive into the file formats used in MS Office, demonstrating many features that can be used offensively. They will present attacks that apply to both the legacy formats (OLE streams) and the newer XML based documents. Specific focus is around the internal representation of VBA macros and pseudo code (p-code, execodes) and how these can be weaponized. We will detail the inner logic of Word and Excel regarding VBA and p-code, and release scripts and tools for creating malicious Office documents that bypass anti-virus, YARA rules, AMSI for VBA and various MS Office document analyzers.
  • Bypass Blogposts
    • Antimalware Scan Interface (AMSI) — A Red Team Analysis on Evasion - iwantmore.pizza
    • How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code - modexp
    • PowerShell ScriptBlock Logging Bypass - cobbr.io
    • Bypassing Amsi using PowerShell 5 DLL Hijacking - cn33liz
    • Bypass for PowerShell ScriptBlock Warning Logging of Suspicious Commands - cobbr.io
    • Alternative AMSI bypass - Benoit Sevens
    • AMSI Bypass With a Null Character - satoshi's note
    • Disabling AMSI in JScript with One Simple Trick - James Forshaw
    • AMSI Bypass: Patching Technique - Avi Gimpel & Zeev Ben Porat
    • AMSI Bypass Redux - Avi Gimpel
    • Bypassing AMSI via COM Server Hijacking - Enigma0x3
      • This post will highlight a way to bypass AMSI by hijacking the AMSI COM server, analyze how Microsoft fixed it in build #16232 and then how to bypass that fix. This issue was reported to Microsoft on May 3rd, and has been fixed as a Defense in Depth patch in build #16232.
    • Sneaking Past Device Guard - Philip Tsukerman
    • Red Team TTPs Part 1: AMSI Evasion - 0xDarkVortex.dev
    • RastaMouse AmsiScanBuffer Bypass Series
      • Part 1
      • Part 2
      • Part 3
      • Part 4
    • How to bypass AMSI and execute ANY malicious Powershell code - zc00l
    • Weaponizing AMSI bypass with PowerShell - @0xB455
    • How to Bypass AMSI with an Unconventional Powershell Cradle - Mohammed Danish
    • Bypassing AMSI via COM Server Hijacking - Matt Nelson
      • fixed as a Defense in Depth patch in build #16232.
    • Adventures in the Wonderful World of AMSI. - byte_st0rm
    • How to bypass AMSI and execute ANY malicious Powershell code - zc00l
  • Bypass Talks
    • Antimalware Scan Interface (AMSI) - Dave Kennedy(WWHF2018)
      • This talk will dive into the Antimalware Scan Interface (AMSI) as well as other alternatives in the “NextGen” series of preventative measures and show how trivial it is to write code that doesn’t get snagged. The security market is focusing on open source data collection sources and security researchers as the main method to write signatures to detect attacks, much like what we saw in the 90s with traditional anti-virus tech. Not much has changed, let’s dive into the reality in security and how little these protective measures really do in the grand scheme of things. We’ll also be covering solid practices in defending against attacks, and what we should be focusing on.
    • PSAmsi An offensive PowerShell module for interacting with the Anti Malware Scan Interface in Windows - Ryan Cobb(Derbycon7)
    • [The Rise and Fall of AMSI - Tal Liberman(BH Asia18)]https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf)
    • Red Team TTPs Part 1: AMSI Evasion - paranoidninja
    • AMSI: How Windows 10 Plans To Stop Script Based Attacks And How Well It Does It - Nikhil Mittal(BHUSA16)
    • Goodbye Obfuscation, Hello Invisi-Shell: Hiding Your Powershell Script in Plain Sight - Omer Yair(Derbycon2018)
      • “The very concept of objective truth is fading out of the world. Lies will pass into history.” George Orwell. Objective truth is essential for security. Logs, notifications and saved data must reflect the actual events for security tools, forensic teams and IT managers to perform their job correctly. Powershell is a prime example of the constant cat and mouse game hackers and security personnel play every day to either reveal or hide the “objective truth” of a running script. Powershell’s auto logging, obfuscation techniques, AMSI and more are all participants of the same game playing by the same rules. We don’t like rules, so we broke them. As a result, Babel-Shellfish and Invisi-Shelltwo new tools that both expose and disguise powershell scripts were born. Babel-Shellfish reveals the inner hidden code of any obfuscated script while Invisi-Shell offers a new method of hiding malicious scripts, even from the Powershell process running it. Join us as we present a new way to think about scripts.
  • Bypass Tools
    • Invisi-Shell
    • AmsiScanBufferBypass
      • Circumvent AMSI by patching AmsiScanBuffer
    • CorruptCLRGlobal.ps1
      • A PoC function to corrupt the g_amsiContext global variable in clr.dll in .NET Framework Early Access build 3694 Raw
    • AMSI Bypass Code Snippet Examples
      • "This repo contains some Amsi Bypass methods i found on different Blog Posts."
    • PSAmsi
      • PSAmsi is a tool for auditing and defeating AMSI signatures. It's best utilized in a test environment to quickly create payloads you know will not be detected by a particular AntiMalware Provider, although it can be useful in certain situations outside of a test environment. When using outside of a test environment, be sure to understand how PSAmsi works, as it can generate AMSI alerts.
    • powershellveryless
      • Constrained Language Mode + AMSI bypass all in one
    • AmsiBypass
      • C# PoC implementation for bypassing AMSI via in memory patching
    • NoAmci
      • A PoC for using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load(). .Net tradecraft can be compressed, encoded (encrypted if required) in order to keep the assembly size less than 1MB, then embedded as a resource to be loaded after patching amsi.dll memory.
  • VBA Specific
    • 101
      • Office VBA + AMSI: Parting the veil on malicious macros - MS Security Team
    • Blogposts
      • Dynamic Microsoft Office 365 AMSI In Memory Bypass Using VBA - Richard Davy, Gary Nield
      • The Document that Eluded AppLocker and AMSI - ZLAB-YOROI
      • Office 365 AMSI Bypass (fixed) - Ring0x00
    • Talks & Presentations
      • Bypassing AMSI for VBA - Pieter Ceelen
        • This blog is a writeup of the various AMSI weaknesses presented at the Troopers talk ‘MS Office File Format Sorcery‘ and the Blackhat Asia presentation ‘Office in Wonderland’.
• Windows Defender
  • DefenderCheck
    • Takes a binary as input and splits it until it pinpoints that exact byte that Microsoft Defender will flag on, and then prints those offending bytes to the screen.
• DeviceGuard Bypass
  • Articles/Blogposts/Talks/Writeups
    • Defeating Device Guard: A look into CVE-2017-0007
    • DeviceGuard Bypasses - James Forshaw
      • This solution contains some of my UMCI/Device Guard bypasses. They're are designed to allow you to analyze a system, such as Windows 10 S which comes pre-configured with a restrictive UMCI policy.
    • Consider Application Whitelisting with Device Guard
    • Bypassing Application Whitelisting using MSBuild.exe - Device guard Example and Mitigations
    • Defeating Device Guard: A look into CVE-2017–0007 - Matt Nelson
    • UMCI vs Internet Explorer: Exploring CVE-2017–8625 - Matt Nelson
    • Sneaking Past Device Guard - Philip Tsukerman(Troopers19)
    • Windows: LUAFV NtSetCachedSigningLevel Device Guard Bypass - Google
  • Tools
    • Window 10 Device Guard Bypass
• EDR
  • Articles/Blogposts/Writeups
    • Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR - Cornelis de Plaa
    • Dechaining Macros and Evading EDR
    • Bypass EDR’s memory protection, introduction to hooking
    • Bypassing Cylance and other AVs/EDRs by Unhooking Windows APIs - ired.team
    • Silencing Cylance: A Case Study in Modern EDRs
    • Cylance, I Kill You! - Shahar Zini
      • Slides
  • Talks & Presentations
    • Red Teaming in the EDR age - Will Burgess
  • Tools
    • Sharp-Suite - Process Argument Spoofing
  • Zombie Ant Farm
    • Primitives and Offensive Tooling for Linux EDR evasion.
• Logging
  • Invoke-Phant0m
    • This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
• Secured Environment Escape
  • 101
    • Sandboxes from a pen tester’s view - Rahul Kashyap
      • Description: In this talk we’ll do an architectural decomposition of application sandboxing technology from a security perspective. We look at various popular sandboxes such as Google Chrome, Adobe ReaderX, Sandboxie amongst others and discuss the limitations of each technology and it’s implementation. Further, we discuss in depth with live exploits how to break out of each category of sandbox by leveraging various kernel and user mode exploits – something that future malware could leverage. Some of these exploit vectors have not been discussed widely and awareness is important.
  • Adobe Sandbox
    • Adobe Sandbox: When the Broker is Broken - Peter Vreugdenhill
  • chroot
    • chw00t: chroot escape tool
    • Breaking Out of a Chroot Jail Using PERL
  • Breaking out of Contained Linux Shells
    • Escaping Restricted Linux Shells - SANS
    • Breaking out of rbash using scp - pentestmonkey
    • Escape From SHELLcatraz - Breaking Out of Restricted Unix Shells - knaps
    • How to break out of restricted shells with tcpdump - Oiver Matula
  • Python Sandbox
    • Escaping a Python sandbox with a memory corruption bug
    • Breaking out of secured Python environments
    • Sandboxed Execution Environment
    • Documentation
      • Sandboxed Execution Environment (SEE) is a framework for building test automation in secured Environments. The Sandboxes, provided via libvirt, are customizable allowing high degree of flexibility. Different type of Hypervisors (Qemu, VirtualBox, LXC) can be employed to run the Test Environments.
    • Usermode Sandboxing
  • ssh
    • ssh environment - circumvention of restricted shells
  • Windows
    • Windows Desktop Breakout
    • Kiosk/POS Breakout Keys in Windows - TrustedSec
    • menu2eng.txt - How To Break Out of Restricted Shells and Menus, v2.3(1999)
    • Kiosk Escapes Pt 2 - Ft. Microsoft Edge!! - H4cklife
      • TL/DR: Microsoft Edge brings up Windows Explorer when you navigate to C:\ in the URL; Win+x can be used to access the start menu when shortcut keys are limited
      • An excellent whitepaper detailing methods for breaking out of virtually any kind of restricted shell or menu you might come across.
  • VDI
    • Breaking Out! of Applications Deployed via Terminal Services, Citrix, and Kiosks
    • Breaking Out of Citrix and other Restricted Desktop Environments
    • Pentests in restricted VDI environments - Viatcheslav Zhilin
  • VirtualMachine
    • Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine - Joe Bialek
    • L1TF (Foreshadow) VM guest to host memory read PoC
      • This is a PoC for CVE-2018-3646. This is a vulnerability that enables malicious/compromised VM guests to read host machine physical memory. The vulnerability is exploitable on most Intel CPUs that support VT-x and EPT (extended page tables). This includes all Intel Core iX CPUs. This PoC works only on 64 bit x86-64 systems (host and guest).
• Sysmon
  • Shhmon - Neuter Sysmon by unloading its driver
  • Subverting Sysmon materials
  • Sysmon configuration bypass finder
    • Detect possible sysmon logging bypasses given a specific configuration
• Windows User Account Control(UAC)
  • 101
    • User Account Control - docs.ms
    • User Account Control Step-by-Step Guide - docs.ms
    • User Account Control - Steven Sinofsky(blogs.msdn)](https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-control/)
    • Inside Windows Vista User Account Control - docs.ms
    • Inside Windows 7 User Account Control - docs.ms
  • Articles/Blogposts/Writeups
    • Anatomy of UAC Attacks - b33f
    • Farewell to the Token Stealing UAC Bypass - tyranidslair.blogspot
    • Testing UAC on Windows 10 - Ernesto Fernandez
      • User Account Control (UAC) is a mechanism implemented in Windows systems from Vista to prevent malicious software from executing with administrative privileges without user consent. However, this mechanism does not provide a secure solution to that problem, since can be easily bypassed in some ways, something we will show by means of different methods such as DLL hijacking, token impersonation or COM interface elevation, also we will show a new method which we have developed based on a previous one. Moreover, this new Proof of Concept has been ported to the Metasploit Framework as a new module, which indeed is the only UAC bypass module that works in the latest Windows 10 build version.
    • Reading Your Way Around UAC (Part 1)
      • Reading Your Way Around UAC (Part 2)
      • Reading Your Way Around UAC (Part 3)
    • Testing User Account Control (UAC) on Windows 10 - Ernesto Fernández Provecho
  • Bypasses
    • Bypassing Windows User Account Control (UAC) and ways of mitigation
    • Bypassing User Account Control (UAC) using TpmInit.exe - uacmeltdown.blogspot
    • UAC Bypass in System Reset Binary via DLL Hijacking - activecyber.us
    • Bypassing UAC using App Paths - Matt Nelson
    • Bypassing UAC on Windows 10 using Disk Cleanup
    • Research on CMSTP.exe
      • Methods to bypass UAC and load a DLL over webdav
    • Bypassing UAC using App Paths
    • “Fileless” UAC Bypass Using eventvwr.exe and Registry Hijacking
    • Fileless UAC Bypass using sdclt
    • Eventvwr File-less UAC Bypass CNA
    • How to bypass UAC in newer Windows versions - zcool(Oct2018)
    • Fileless UAC Bypass in Windows Store Binary - activecyber.us
    • Fileless_UAC_bypass_WSReset
  • Talks & Presentations
    • Not a Security Boundary: Bypassing User Account Control - Matt Nelson(Derbycon7)
  • Tools
    • UACME
      • Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor.
    • DccwBypassUAC
      • This exploit abuses the way "WinSxS" is managed by "dccw.exe" by means of a derivative Leo's Davidson "Bypass UAC" method so as to obtain an administrator shell without prompting for consent. It supports "x86" and "x64" architectures. Moreover, it has been successfully tested on Windows 8.1 9600, Windows 10 14393, Windows 10 15031 and Windows 10 15062.
    • Bypass-UAC
      • Bypass-UAC provides a framework to perform UAC bypasses based on auto elevating IFileOperation COM object method calls. This is not a new technique, traditionally, this is accomplished by injecting a DLL into "explorer.exe". This is not desirable because injecting into explorer may trigger security alerts and working with unmanaged DLL's makes for an inflexible work-flow. To get around this, Bypass-UAC implements a function which rewrites PowerShell's PEB to give it the appearance of "explorer.exe". This provides the same effect because COM objects exclusively rely on Windows's Process Status API (PSAPI) which reads the process PEB.
    • Bypass-UAC

---

Payloads & Shells

• 101
• Payloads
  • Staged vs Stageless Handlers - OJ Reeves
  • Toying with inheritance - hexacorn
  • Proxy-Aware Payload Testing - redxorblue
    • "I get told that I am too wordy, so if you want the summary, here are some steps to setup a virtual testing environment to test payloads to see if they can handle HTTP(S) proxies and if so, can they authenticate properly through them as well. This post will cover the proxy setup without authentication since that is the easier part, and I will do a second post shortly to hack together the authentication portion of it."
• Handling Shells
  • Alveare
    • Multi-client, multi-threaded reverse shell handler written in Node.js. Alveare (hive in italian) lets you listen for incoming reverse connection, list them, handle and bind the sockets. It's an easy to use tool, useful to handle reverse shells and remote processes.
• Tools to help generate payloads
  • How to use msfvenom
  • msfpc
    • A quick way to generate various "basic" Meterpreter payloads via msfvenom (part of the Metasploit framework).
  • Unicorn
    • Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
  • MorphAES
    • MorphAES is the world's first polymorphic shellcode engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it's cross-platform as well and library-independent.
  • SharpShooter
    • SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of creating payloads in a variety of formats, including HTA, JS, VBS and WSF. It leverages James Forshaw's DotNetToJavaScript tool to invoke methods from the SharpShooter DotNet serialised object. Payloads can be retrieved using Web or DNS delivery or both; SharpShooter is compatible with the MDSec ActiveBreach PowerDNS project. Alternatively, stageless payloads with embedded shellcode execution can also be generated for the same scripting formats.
  • gscript
    • Gscript is a framework for building multi-tenant executors for several implants in a stager. The engine works by embedding runtime logic (powered by the V8 Javascript Virtual Machine) for each persistence technique. This logic gets run at deploy time on the victim machine, in parallel for every implant contained with the stager. The Gscript engine leverages the multi-platform support of Golang to produce final stage one binaries for Windows, Mac, and Linux.
• Techniques
  • Keying
    • GoGreen
      • This project was created to bring environmental (and HTTP) keying to scripting languages. As its common place to use PowerShell/JScript/VBScript as an initial vector of code execution, as a result of phishing or lateral movement, I see value of the techniques for these languages.
  • Polyglot
    • BMP / x86 Polyglot
• (Ex)/(S)ample Payloads and supporting tools written in various languages
  • C & C++
    • Undetectable C# & C++ Reverse Shells - Bank Security
      • Technical overview of different ways to spawn a reverse shell on a victim machine
  • C#
    • EasyNet
      • Packs/unpacks arbitrary data using a simple Data -> Gzip -> AES -> Base64 algorithm. Generates a random AES-256 key and and IV and provides them to the user. Can be used to pack or unpack arbitrary data. Provided both as a program and a library.
    • Inception Framework
      • Inception provides In-memory compilation and reflective loading of C# apps for AV evasion. Payloads are AES encrypted before transmission and are decrypted in memory. The payload server ensures that payloads can only be fetched a pre-determined number of times. Once decrypted, Roslyn is used to build the C# payload in memory, which is then executed using reflection.
  • Go
    • Go-deliver
      • Go-deliver is a payload delivery tool coded in Go. This is the first version and other features will be added in the future.
    • Hershell
      • Simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception.
      • [EN] Golang for pentests : Hershell
  • HTA
    • genHTA
      • Generates anti-sandbox analysis HTA files without payloads
    • morpHTA
      • Morphing Cobalt Strike's evil.HTA
    • Demiguise
      • The aim of this project is to generate .html files that contain an encrypted HTA file. The idea is that when your target visits the page, the key is fetched and the HTA is decrypted dynamically within the browser and pushed directly to the user. This is an evasion technique to get round content / file-type inspection implemented by some security-appliances. This tool is not designed to create awesome HTA content. There are many other tools/techniques that can help you with that. What it might help you with is getting your HTA into an environment in the first place, and (if you use environmental keying) to avoid it being sandboxed.
  • LNK Files
    • LNKUp
      • Generates malicious LNK file payloads for data exfiltration
    • Embedding reverse shell in .lnk file or Old horse attacks
  • MSI Binaries
    • Wix Toolkit
      • Tool for crafting msi binaries
    • Distribution of malicious JAR appended to MSI files signed by third parties
  • .NET
    • DotNetToJScript
      • A tool to create a JScript file which loads a .NET v2 assembly from memory.
    • Payload Generation with CACTUSTORCH
      • Code
  • Powershell
    • Powershell Download Cradles - Matthew Green
    • Invoke-PSImage
      • Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web (when the -Web flag is passed). The least significant 4 bits of 2 color values in each pixel are used to hold the payload. Image quality will suffer as a result, but it still looks decent. The image is saved as a PNG, and can be losslessly compressed without affecting the ability to execute the payload as the data is stored in the colors themselves. It can accept most image types as input, but output will always be a PNG because it needs to be lossless. Each pixel of the image is used to hold one byte of script, so you will need an image with at least as many pixels as bytes in your script. This is fairly easy—for example, Invoke-Mimikatz fits into a 1920x1200 image.
    • Reverse Encrypted (AES 256-bit) Shell over TCP - using PowerShell SecureString.
    • PowerDNS
      • PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell script using DNS only. PowerDNS works by splitting the PowerShell script in to chunks and serving it to the user via DNS TXT records.
  • Python
    • Pupy
      • Pupy is a remote administration tool with an embeded Python interpreter, allowing its modules to load python packages from memory and transparently access remote python objects. The payload is a reflective DLL and leaves no trace on disk
    • Winpayloads
      • Undetectable Windows Payload Generation with extras Running on Python2.7
    • Cloak
      • Cloak generates a python payload via msfvenom and then intelligently injects it into the python script you specify.
  • SCT Files
    • SCT-obfuscator
      • SCT payload obfuscator. Rename variables and change harcoded char value to random one.
  • VBA
    • VBad
      • VBad is fully customizable VBA Obfuscation Tool combined with an MS Office document generator. It aims to help Red & Blue team for attack or defense.

---

Code Injection Stuff

• I Swear I'll get around to this soon™, and make it actually useful/document things
• Agnostic
• Linux
  • 101
  • Articles/Blogposts/Writeups
    • Pure In-Memory (Shell)Code Injection In Linux Userland - blog.sektor7
  • Talks & Presentations
  • Tools
    • Jugaad - Thread Injection Kit
      • Jugaad is an attempt to create CreateRemoteThread() equivalent for *nix platform. The current version supports only Linux operating system. For details on what is the methodology behind jugaad and how things work under the hood visit http://null.co.in/section/projects for a detailed paper.
    • linux-injector
      • Utility for injecting executable code into a running process on x86/x64 Linux. It uses ptrace() to attach to a process, then mmap()'s memory regions for the injected code, a new stack, and space for trampoline shellcode. Finally, the trampoline in the target process is used to create a new thread and execute the chosen shellcode, so the main thread is allowed to continue. This project borrows from a number of other projects and research, see References below.
    • linux-inject
      • Tool for injecting a shared object into a Linux process
    • injectso64
      • This is the x86-64 rewrite of Shaun Clowes' i386/SPARC injectso which he presented at Blackhat Europe 2001.
• OS X
  • 101
  • Articles/Blogposts/Writeups
  • Talks & Presentations
  • Tools
• Python
  • 101
  • Articles/Blogposts/Writeups
    • Code injection on Windows using Python: a simple example - andreafortuna
  • Talks & Presentations
  • Tools
    • pyrasite
      • Tools for injecting arbitrary code into running Python processes.
    • Equip: python bytecode instrumentation
      • equip is a small library that helps with Python bytecode instrumentation. Its API is designed to be small and flexible to enable a wide range of possible instrumentations. The instrumentation is designed around the injection of bytecode inside the bytecode of the program to be instrumented. However, the developer does not need to know anything about the Python bytecode since the injected code is Python source.
• Windows
  • 101
  • DLL
    • injectAllTheThings
      • Single Visual Studio project implementing multiple DLL injection techniques (actually 7 different techniques) that work both for 32 and 64 bits. Each technique has its own source code file to make it easy way to read and understand.
      • Inject All the Things - Shut up and hack
  • Articles/Blogposts/Writeups
    • InjectProc - Process Injection Techniques
    • Injecting Code into Windows Protected Processes using COM - Part 1 - James Forshaw(P0)
    • Injecting Code into Windows Protected Processes using COM - Part 2 - James Forshaw(P0)
  • Talks & Presentations
    • Injection on Steroids: Code less Code Injections and 0 Day Techniques - Paul Schofield Udi Yavo
      • Blogpost
    • Less is More, Exploring Code/Process-less Techniques and Other Weird Machine Methods to Hide Code (and How to Detect Them)
  • Tools
    • InfectPE
      • Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files.
    • PowerLoaderEX
      • Advanced Code Injection Technique for x32 / x64