Investigation about ACL abusing for Active Directory Certificate Services (AD CS)
☆135Oct 10, 2021Updated 4 years ago
Alternatives and similar repositories for Abusing_Weak_ACL_on_Certificate_Templates
Users that are interested in Abusing_Weak_ACL_on_Certificate_Templates are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ADCS cert template modification and ACL enumeration☆145Jun 26, 2023Updated 3 years ago
- ADCS abuser☆323Feb 6, 2023Updated 3 years ago
- WhoAmI by asking the LDAP service on a domain controller.☆67Feb 8, 2022Updated 4 years ago
- Collection of remote authentication triggers in C#☆537May 15, 2024Updated 2 years ago
- MS-FSRVP coercion abuse PoC☆302Dec 30, 2021Updated 4 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- C# version of Powermad☆172Dec 5, 2023Updated 2 years ago
- NTLM relaying for Windows made easy☆582Apr 25, 2023Updated 3 years ago
- Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions☆98Mar 8, 2023Updated 3 years ago
- A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.☆142Sep 24, 2021Updated 4 years ago
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2☆187Jul 21, 2022Updated 4 years ago
- DirSync is a simple proof of concept PowerShell module to demonstrate the impact of delegating DS-Replication-Get-Changes and DS-Replicat…☆30Apr 26, 2023Updated 3 years ago
- Convert ldapdomaindump to Bloodhound☆81Dec 19, 2023Updated 2 years ago
- Check for LDAP protections regarding the relay of NTLM authentication☆531Nov 19, 2024Updated last year
- Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!☆450Mar 8, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Local SYSTEM auth trigger for relaying☆173Jul 22, 2025Updated last year
- LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript☆347Sep 1, 2021Updated 4 years ago
- .NET 4.0 WinRM API Command Execution☆165Sep 11, 2020Updated 5 years ago
- Buggy script to play with GPOs☆132Jul 14, 2026Updated last week
- C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc!☆181Aug 4, 2021Updated 4 years ago
- SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket☆974Jul 26, 2021Updated 4 years ago
- An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).☆419Jan 27, 2024Updated 2 years ago
- Spray a hash via smb to check for local administrator access☆143Feb 7, 2021Updated 5 years ago
- official repo for the AdHuntTool (part of the old RedTeamCSharpScripts repo)☆234Jun 10, 2022Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Click Once + App Domain☆69Feb 23, 2026Updated 4 months ago
- A .NET tool for exporting and importing certificates without touching disk.☆501Oct 8, 2021Updated 4 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆350May 30, 2023Updated 3 years ago
- ☆499Nov 20, 2022Updated 3 years ago
- Federated Office365 user enumeration based on correlated response trend analysis☆49May 3, 2022Updated 4 years ago
- A Combination LSASS Dumper and LSASS Parser. All Credit goes to @slyd0g and @cube0x0.☆148Nov 21, 2021Updated 4 years ago
- ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-ob…☆1,093Jul 10, 2026Updated last week
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective☆181May 31, 2026Updated last month
- Strstr with user-supplied needle and filename as a BOF.☆32Sep 27, 2021Updated 4 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- A .NET implementation to dump SAM, SYSTEM, SECURITY registry hives from a remote host☆41Dec 8, 2023Updated 2 years ago
- Framework for Kerberos relaying☆954May 29, 2022Updated 4 years ago
- PoC to coerce authentication from Windows hosts using MS-WSP☆305Sep 7, 2023Updated 2 years ago
- Dumping DPAPI credz remotely☆1,396Mar 24, 2025Updated last year
- UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …☆349Jul 3, 2022Updated 4 years ago
- Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that b…☆219Jul 14, 2021Updated 5 years ago
- Tools for Kerberos PKINIT and relaying to AD CS☆911Jan 3, 2025Updated last year