Investigation about ACL abusing for Active Directory Certificate Services (AD CS)
☆135Oct 10, 2021Updated 5 years ago
Alternatives and similar repositories for Abusing_Weak_ACL_on_Certificate_Templates
Users that are interested in Abusing_Weak_ACL_on_Certificate_Templates are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ADCS cert template modification and ACL enumeration☆145Jun 26, 2023Updated 3 years ago
- MS-FSRVP coercion abuse PoC☆304Dec 30, 2021Updated 4 years ago
- ADCS abuser☆325Feb 6, 2023Updated 3 years ago
- NTLM relaying for Windows made easy☆585Apr 25, 2023Updated 3 years ago
- WhoAmI by asking the LDAP service on a domain controller.☆67Feb 8, 2022Updated 4 years ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- DirSync is a simple proof of concept PowerShell module to demonstrate the impact of delegating DS-Replication-Get-Changes and DS-Replicat…☆31Apr 26, 2023Updated 3 years ago
- Collection of remote authentication triggers in C#☆542May 15, 2024Updated 2 years ago
- Spray a hash via smb to check for local administrator access☆143Feb 7, 2021Updated 5 years ago
- official repo for the AdHuntTool (part of the old RedTeamCSharpScripts repo)☆235Jun 10, 2022Updated 4 years ago
- C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc!☆181Aug 4, 2021Updated 5 years ago
- A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.☆142Sep 24, 2021Updated 5 years ago
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2☆186Jul 21, 2022Updated 4 years ago
- Local SYSTEM auth trigger for relaying☆173Jul 22, 2025Updated last year
- Check for LDAP protections regarding the relay of NTLM authentication☆532Nov 19, 2024Updated last year
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- C# version of Powermad☆172Dec 5, 2023Updated 2 years ago
- Federated Office365 user enumeration based on correlated response trend analysis☆49May 3, 2022Updated 4 years ago
- Click Once + App Domain☆69Feb 23, 2026Updated 8 months ago
- Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…☆220Jul 14, 2021Updated 5 years ago
- Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!☆450Mar 8, 2023Updated 3 years ago
- Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions☆96Mar 8, 2023Updated 3 years ago
- Convert ldapdomaindump to Bloodhound☆80Dec 19, 2023Updated 2 years ago
- Remotely enables Restricted Admin Mode☆214Sep 3, 2021Updated 5 years ago
- .NET 4.0 WinRM API Command Execution☆165Sep 11, 2020Updated 6 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A .NET tool for exporting and importing certificates without touching disk.☆502Oct 8, 2021Updated 5 years ago
- UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …☆348Jul 3, 2022Updated 4 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆349May 30, 2023Updated 3 years ago
- SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket☆984Jul 26, 2021Updated 5 years ago
- Framework for Kerberos relaying☆959May 29, 2022Updated 4 years ago
- A Combination LSASS Dumper and LSASS Parser. All Credit goes to @slyd0g and @cube0x0.☆148Nov 21, 2021Updated 4 years ago
- Fileless Command Execution for Lateral Movement in Nim☆403Apr 4, 2026Updated 6 months ago
- Buggy script to play with GPOs☆138Jul 14, 2026Updated 3 months ago
- An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).☆421Jan 27, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Strstr with user-supplied needle and filename as a BOF.☆32Sep 27, 2021Updated 5 years ago
- ☆100Aug 23, 2021Updated 5 years ago
- ☆507Nov 20, 2022Updated 3 years ago
- PoC to coerce authentication from Windows hosts using MS-WSP☆307Sep 7, 2023Updated 3 years ago
- Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, …☆959Nov 11, 2024Updated last year
- ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-ob…☆1,107Updated this week
- ☆78Jun 17, 2025Updated last year