Quick and dirty PowerShell script to abuse the overly permissive capabilities of the SYSTEM user in a child domain on the Public Key Services and Enrollment Services ADCS containers to obtain Enterprise Administrator from Domain Administrator. Works by enabling a user to perform ESC1 (Enrolee supplying the SAN).
☆29Jul 25, 2023Updated 3 years ago
Alternatives and similar repositories for PKI-Escalate
Users that are interested in PKI-Escalate are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆19Dec 25, 2025Updated 10 months ago
- Pure PowerShell port of PassTheCert tool to authenticate to an LDAP/S server with a certificate through Schannel☆65Apr 13, 2025Updated last year
- GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstal…☆35Nov 24, 2024Updated last year
- Pure PowerShell port of PassTheCert tool to authenticate to an LDAP/S server with a certificate through Schannel☆18May 22, 2026Updated 5 months ago
- DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will auto…☆16Apr 2, 2026Updated 7 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- C# Port of LdapRelayScan☆95Nov 26, 2025Updated 11 months ago
- The Kerberoasting / AD password-audit wordlist I use on engagements: priority-merged HashMob large list + The-Viper-One's kerberoast_pws,…☆16Oct 2, 2026Updated last month
- aggregated repo for all conferences and talks I am giving☆17Oct 30, 2021Updated 5 years ago
- Cobalt Strike BOF☆58Dec 10, 2025Updated 10 months ago
- Steal Net-NTLMv1 hashes for logged on users without dumping LSASS☆16May 11, 2026Updated 5 months ago
- Adaptive DLL hijacking / dynamic export forwarding - EAT preserve☆80Aug 5, 2024Updated 2 years ago
- ☆40Sep 25, 2026Updated last month
- A simple PE loader.☆27Dec 9, 2022Updated 3 years ago
- ☆19Sep 17, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Brute Ratel LDAP filtering and sorting tool. Easily take BR log output and pull hostnames for ease of use with other red team tooling. Su…☆39Nov 16, 2023Updated 2 years ago
- conduct lateral movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine☆55Jun 14, 2021Updated 5 years ago
- Proof-of-Concept to evade auditd by tampering via ptrace☆19Aug 3, 2023Updated 3 years ago
- ☆43Oct 8, 2024Updated 2 years ago
- ☆25Sep 6, 2025Updated last year
- Assess Kerberos Cipher and Hash usage in Active Directory environments (e.g. Weak/Deprecated encryption types, or Post-Quantum acceptable…☆11Sep 9, 2025Updated last year
- Oracle Database TNS Listener Poison Attack Vulnerability☆11Oct 12, 2017Updated 9 years ago
- MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection.☆351Aug 7, 2024Updated 2 years ago
- ☆13Feb 4, 2025Updated last year
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Mentally ill EtwTi parser☆74Jan 11, 2026Updated 9 months ago
- Simple script to bypass AMSI on Win 10 and Win 11 by exploiting AmsiOpenSession☆18Jan 2, 2026Updated 10 months ago
- Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy☆170Nov 17, 2025Updated 11 months ago
- all random stuff that dont warrant a seperate repo☆12Sep 2, 2022Updated 4 years ago
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆218Oct 19, 2024Updated 2 years ago
- General Purpose OpSec Server☆116Updated this week
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆100Aug 27, 2023Updated 3 years ago
- Sparkle - LLM Honeypot for Security Research☆14Jul 28, 2026Updated 3 months ago
- Backend development stack for agents☆28Jul 30, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- ☆166May 5, 2025Updated last year
- A C# project that builds a Web Application which redirects all HTTPS☆28Feb 11, 2025Updated last year
- Identifies LOLDrivers that are not blocked by the active HVCI policy — ideal for BYOVD scenarios.☆44Oct 27, 2026Updated last week
- Process injection via KernelCallbackTable☆13Jan 28, 2022Updated 4 years ago
- Spot all domain controllers in a Microsoft Active Directory environment. Find computer name, FQDN, and IP address(es) of all DCs.☆19Jun 23, 2024Updated 2 years ago
- ☆22Jun 24, 2025Updated last year
- A tool for carrying out brute force attacks against Office 365, with built in IP rotation use AWS gateways.☆79Jun 6, 2024Updated 2 years ago