Windows Penetration Testing
Last updated
Last updated
A PowerShell tool and a .NET port of the same used to gain situational awareness in AD. These tools can be used as replacements for various Windows net* commands and more. PowerView and SharpView can help us gather much of the data that BloodHound does, but it requires more work to make meaningful relationships among all of the data points. These tools are great for checking what additional access we may have with a new set of credentials, targeting specific users or computers, or finding some "quick wins" such as users that can be attacked via Kerberoasting or ASREPRoasting.
The C# data collector to gather information from Active Directory about varying AD objects such as users, groups, computers, ACLs, GPOs, user and computer attributes, user sessions, and more. The tool produces JSON files which can then be ingested into the BloodHound GUI tool for analysis.
A tool written in Go that uses Kerberos Pre-Authentication to enumerate Active Directory accounts and perform password spraying and brute forcing.
A collection of tools written in Python for interacting with network protocols. The suite of tools contains various scripts for enumerating and attacking Active Directory.
Responder is a purpose built tool to poison LLMNR, NBT-NS and MDNS, with many different functions.
Similar to Responder, a PowerShell tool for performing various network spoofing and poisoning attacks.
The C# version of Inveigh with with a semi-interactive console for interacting with captured data such as username and password hashes.
A part of the Samba suite on Linux distributions that can be used to perform a variety of Active Directory enumeration tasks via the remote RPC service.
CME is an enumeration, attack, and post-exploitation toolkit which can help us greatly in enumeration and performing attacks with the data we gather. CME attempts to "live off the land" and abuse built-in AD features and protocols such as SMB, WMI, WinRM, and MSSQL.
Rubeus is a C# tool built for Kerberos Abuse.
Another Impacket module geared towards finding Service Principal names tied to normal users.
A great hashcracking and password recovery tool.
A tool for enumerating information from Windows and Samba systems.
A rework of the original Enum4linux tool that works a bit differently.
Built in interface for interacting with the LDAP protocol.
A Python script used to enumerate AD users, groups, and computers using LDAP queries. Useful for automating custom LDAP queries.
DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
The toolkit includes functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).
SMB share enumeration across a domain.
Part of the Impacket toolset, it provides us with psexec like functionality in the form of a semi-interactive shell.
Part of Impacket toolset, it provides the capability of command execution over WMI.
Useful for finding information (such as credentials) in Active Directory on computers with accessible file shares.
Simple SMB server execution for interaction with Windows hosts. Easy way to transfer files within a network.
Reads, modifies, and deletes the Service Principal Names (SPN) directory property for an Active Directory service account.
Performs many functions. Noteably, pass-the-hash attacks, extracting plaintext passwords, and kerberos ticket extraction from memory on host.
Remotely dump SAM and LSA secrets from a host.
Provides us with an interactive shell on host over the WinRM protocol.
Part of Impacket toolset, it provides the ability to interact with MSSQL databases.
Exploit combo using CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user.
Part of the Impacket toolset, RPC endpoint mapper.
Printnightmare PoC in python.
Part of the Impacket toolset, it performs SMB relay attacks.
PoC tool for CVE-2021-36942 to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.
Tool for manipulating certificates and TGTs.
This tool will use an existing TGT to request a PAC for the current user using U2U.
A tool for enumeration and dumping of DNS records from a domain. Similar to performing a DNS Zone transfer.
Extracts usernames and passwords from Group Policy preferences.
Attempt to list and get TGTs for those users that have the property 'Do not require Kerberos preauthentication' set.
SID bruteforcing tool.
A tool for creation and customization of TGT/TGS tickets.
Part of the Impacket toolset, It is a tool for child to parent domain privilege escalation.
Active Directory Explorer (AD Explorer) is an AD viewer and editor. It can be used to navigate an AD database and view object properties and attributes. It can also be used to save a snapshot of an AD database for off-line analysis. When an AD snapshot is loaded, it can be explored as a live version of the database. It can also be used to compare two AD database snapshots to see changes in objects, attributes, and security permissions.
Group3r is useful for auditing and finding security misconfigurations in AD Group Policy Objects (GPO).
A tool used to extract various data from a target AD environment. The data can be output in Microsoft Excel format with summary views and analysis to assist with analysis and paint a picture of the environment's overall security state.
Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).
dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available
authenticate to an LDAP/S server with a certificate through Schannel
This module is intended to simplify various PKI and Active Directory Certificate Services management tasks by using automation with Windows PowerShell.
An intranet comprehensive scanning tool, which is convenient for automatic and omnidirectional missed scanning. It supports host survival detection, port scanning, explosion of common services, ms17010, Redis batch public key writing, planned task rebound shell, reading win network card information, web fingerprint identification, web vulnerability scanning, netbios detection, domain control identification and other functions.
C# project for performing a wide variety of local privilege escalation checks
PowerShell script for finding common Windows privilege escalation vectors that rely on misconfigurations. It can also be used to exploit some of the issues found
C# version of PowerUp
PowerShell script for enumerating privilege escalation vectors written in PowerShell 2.0
SessionGopher is a PowerShell tool that finds and decrypts saved session information for remote access tools. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information
Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.
Tool used for retrieving passwords stored on a local machine from web browsers, chat tools, databases, Git, email, memory dumps, PHP, sysadmin tools, wireless network configurations, internal Windows password storage mechanisms, and more
WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 10, including their Windows Server counterparts, is supported
Kerberos unconstrained delegation abuse toolkit
Gold repo tools :
/
PowerView.py is an alternative for the awesome original script
Used to visually map out AD relationships and help plan attack paths that may otherwise go unnoticed. Uses the PowerShell or C# ingestor to gather data to later be imported into the BloodHound JavaScript (Electron) application with a database for graphical analysis of the AD environment.
A Python-based BloodHound ingestor based on the . It supports most BloodHound collection methods and can be run from a non-domain joined attack box. The output can be ingested into the BloodHound GUI for analysis.
Used for auditing the security level of an AD environment based on a risk assessment and maturity framework (based on adapted to AD security).
is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path.
WinPEAS is a script that searches for possible paths to escalate privileges on Windows hosts. All of the checks are explained
We will use several tools from Sysinternals in our enumeration including , , and
is a tool focused on creating binary shellcodes that can be executed in memory; Donut will generate a shellcode of a .NET binary,
