MWR-CyberSec / AD-CS-Forest-Exploiter
Exploit AD CS misconfiguration allowing privilege escalation and persistence from any child domain to full forest compromise
☆89Updated last year
Alternatives and similar repositories for AD-CS-Forest-Exploiter:
Users that are interested in AD-CS-Forest-Exploiter are comparing it to the libraries listed below
- List of some AD tools I frequently use☆46Updated 2 weeks ago
- Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.☆117Updated 4 months ago
- A tool to abuse weak permissions of Active Directory Discretionary Access Control Lists (DACLs) and Access Control Entries (ACEs)☆52Updated 2 months ago
- Lateral Movement☆122Updated last year
- ☆54Updated 3 months ago
- A GUI wrapper inside of Havoc to interact with bloodhound CE☆71Updated last year
- The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning☆104Updated 10 months ago
- Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement☆158Updated 2 months ago
- Tool to extract username and password of current user from PanGPA in plaintext☆82Updated last month
- ☆37Updated 3 weeks ago
- GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstal…☆30Updated 2 months ago
- Generate password spraying lists based on the pwdLastSet-attribute of users.☆55Updated last year
- Inject RDPThief into memory with PowerShell.☆60Updated last month
- Uses rpcdump to locate the ADCS server, and identify if ESC8 is vulnerable from unauthenticated perspective.☆78Updated 5 months ago
- Duplicate not owned Token from Running Process☆72Updated last year
- ☆45Updated 2 years ago
- ☆79Updated last month
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆185Updated 4 months ago
- Opsec tool for finding user sessions by analyzing event log files through RPC (MS-EVEN)☆63Updated 8 months ago
- Adversary Emulation Framework☆66Updated 6 months ago
- To audit the security of read-only domain controllers☆114Updated last year
- this script adds the ability to encode shellcode (.bin) in XOR,chacha20, AES. You can choose between 2 loaders (Myph / 221b)☆78Updated last year
- ☆58Updated 10 months ago
- .NET deserialization hunter☆76Updated 7 months ago
- ☆74Updated 6 months ago
- Dump Windows SAM hashes☆41Updated last year
- Tool to bypass LSA Protection (aka Protected Process Light)☆44Updated last month
- Example code samples from our ScriptBlock Smuggling Blog post☆88Updated 8 months ago