CCob / lsarelayx
NTLM relaying for Windows made easy
☆547Updated last year
Related projects ⓘ
Alternatives and complementary repositories for lsarelayx
- StandIn is a small .NET35/45 AD post-exploitation toolkit☆704Updated 11 months ago
- Standalone implementation of a part of the WSUS spec. Built for offensive security purposes.☆294Updated 2 years ago
- Command line interface to dump LSASS memory to disk via SilentProcessExit☆442Updated 3 years ago
- ☆499Updated 3 years ago
- Check for LDAP protections regarding the relay of NTLM authentication☆464Updated this week
- Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime pat…☆839Updated 3 years ago
- Kerberos Resource-Based Constrained Delegation Attack from Outside using Impacket☆496Updated 2 years ago
- The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.☆466Updated 2 years ago
- An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).☆394Updated 9 months ago
- Cobalt Strike kit for Lateral Movement☆647Updated 4 years ago
- WSuspicious - A tool to abuse insecure WSUS connections for privilege escalations☆346Updated 4 years ago
- Get file less command execution for lateral movement.☆603Updated 2 years ago
- Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks b…☆429Updated last year
- SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket☆767Updated 3 years ago
- A .NET Framework 4.0 Windows Agent☆454Updated last week
- TCP Port Redirection Utility☆677Updated last year
- Framework for Kerberos relaying☆868Updated 2 years ago
- ☆349Updated 3 years ago
- C# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process.☆376Updated 2 months ago
- ☆350Updated 3 years ago
- Various Cobalt Strike BOFs☆581Updated 2 years ago
- A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certifica…☆817Updated last year
- ☆442Updated 2 years ago
- OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at s…☆503Updated 2 years ago
- A User Impersonation tool - via Token or Shellcode injection☆403Updated 2 years ago
- Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands☆975Updated 3 years ago
- Collection of remote authentication triggers in C#☆465Updated 6 months ago
- PIC lsass dumper using cloned handles☆573Updated 2 years ago