Introductory guide on the configuration and subsequent exploitation of Active Directory Certificate Services with Certipy. Based on the white paper Certified Pre-Owned.
☆143Sep 4, 2023Updated 3 years ago
Alternatives and similar repositories for Practice-AD-CS-Domain-Escalation
Users that are interested in Practice-AD-CS-Domain-Escalation are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section☆112Jul 15, 2023Updated 3 years ago
- linikatz is a tool to attack AD on UNIX☆156Oct 19, 2023Updated 3 years ago
- Bypassing UAC with SSPI Datagram Contexts☆474Sep 24, 2023Updated 3 years ago
- Red teaming tool to dump LSASS memory, bypassing basic countermeasures.☆246Aug 2, 2026Updated 2 months ago
- SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain.…☆961Updated this week
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework☆650May 8, 2025Updated last year
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆217Oct 19, 2024Updated 2 years ago
- An executable that simplifies adding the msds-AllowedToActOnBehalfOfOtherIdentity attribute for RBCD☆50Mar 10, 2025Updated last year
- SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai.☆433Sep 26, 2025Updated last year
- Powerview on steroids☆1,013Oct 18, 2026Updated last week
- Active Directory certificate abuse☆42Oct 9, 2022Updated 4 years ago
- LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and r…☆385Apr 26, 2025Updated last year
- AD ACL abuse☆415Sep 15, 2026Updated last month
- An App Domain Manager Injection DLL PoC on steroids☆242Dec 14, 2023Updated 2 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Dominate Active Directory with PowerShell.☆1,207Sep 17, 2026Updated last month
- Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)☆750Aug 17, 2026Updated 2 months ago
- DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.☆103Sep 18, 2023Updated 3 years ago
- PoC module to demonstrate automated lateral movement with the Havoc C2 framework.☆315Dec 9, 2023Updated 2 years ago
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆813Jan 26, 2026Updated 9 months ago
- Fileless atexec, no more need for port 445☆413Mar 28, 2024Updated 2 years ago
- Amsi Bypass payload that works on Windwos 11☆379Jul 30, 2023Updated 3 years ago
- PowerShell scripts for alternative SharpHound enumeration, including users, groups, computers, and certificates, using the ActiveDirector…☆415Jan 14, 2026Updated 9 months ago
- Splitting and executing shellcode across multiple pages☆102Jun 8, 2023Updated 3 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- A litterbox integration for the Mythic Command and Control Server☆21Sep 14, 2026Updated last month
- Materials for the workshop "Red Team Ops: Havoc 101"☆403Oct 6, 2024Updated 2 years ago
- Kerberos relaying and unconstrained delegation abuse toolkit☆1,688Oct 23, 2026Updated last week
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆326Apr 12, 2024Updated 2 years ago
- A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)☆1,505Sep 9, 2026Updated last month
- Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…☆189Aug 2, 2023Updated 3 years ago
- SeManageVolumePrivilege to SYSTEM☆165Nov 22, 2023Updated 2 years ago
- Just another C2 Redirector using CloudFlare. Support multiple C2 and multiple domains. Support for websocket listener.☆216Mar 14, 2025Updated last year
- Bruteforces Fortinet SSL VPNs☆58Sep 19, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- A tool to abuse weak permissions of Active Directory Discretionary Access Control Lists (DACLs) and Access Control Entries (ACEs)☆64Feb 4, 2026Updated 8 months ago
- SeRestorePrivilege to SYSTEM☆153Oct 8, 2021Updated 5 years ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆397Dec 13, 2024Updated last year
- ☆347Jun 24, 2026Updated 4 months ago
- Some scripts to abuse kerberos using Powershell☆367Apr 10, 2026Updated 6 months ago
- Generate password spraying lists based on the pwdLastSet-attribute of users.☆55Dec 6, 2023Updated 2 years ago
- vulnlab.com reaper writeup☆27Aug 30, 2023Updated 3 years ago