Flangvik / ADCSPwn
A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
☆41Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for ADCSPwn
- A little scanner to check the LDAP Signing state☆46Updated 3 years ago
- WhoAmI by asking the LDAP service on a domain controller.☆58Updated 2 years ago
- ☆90Updated 3 years ago
- Execute Mimikatz with different technique☆50Updated 3 years ago
- quick 'n dirty poc based on PoC windows auth prompt in c# based on https://gist.githubusercontent.com/mayuki/339952/raw/2c36b735bc51861a3…☆31Updated 4 years ago
- PoC to interact with local/remote registry hives through WMI☆83Updated 4 years ago
- C# port of LogServiceCrash☆45Updated 4 years ago
- ☆66Updated 3 years ago
- IOXIDResolver from AirBus Security/PingCastle☆45Updated 4 years ago
- Determine if the WebClient Service (WebDAV) is running on a remote system☆26Updated 3 years ago
- Active Directory certificate abuse.☆36Updated 2 years ago
- Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions☆50Updated 2 years ago
- .Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploit noPac☆60Updated last year
- A BOF port of the research of @thefLinkk and @codewhitesec☆94Updated 3 years ago
- ☆58Updated 2 years ago
- C# POC code for the SessionEnv dll hijack by utilizing called functions of TSMSISrv.dll☆58Updated 5 years ago
- ☆54Updated 3 years ago
- ☆35Updated 2 years ago
- Service Enumeration C# .NET Assembly☆59Updated 3 years ago
- (PoC) Tiny Excel BIFF8 Generator, to Embedded 4.0 Macros in xls files without Excel.☆42Updated 3 years ago
- juicypotato for win10 > 1803 & win server 2019☆95Updated 3 years ago
- Example of running C3 (https://github.com/FSecureLABS/C3) in a Docker container☆26Updated 3 years ago
- Run PowerShell command without invoking powershell.exe☆35Updated 3 years ago
- Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged p…☆49Updated 2 years ago
- Get or remove RunMRU values☆52Updated 4 years ago
- Modified version of Pypykatz to print encrypted credentials☆51Updated last year
- .NET 4.0 Scheduled Job Lateral Movement☆86Updated 4 years ago
- Timestomping module: overwrite file create/modify times in .NET (no pinvoke)☆22Updated 2 years ago