zblurx / acltoolkit
ACL abuse swiss-knife
☆119Updated 2 years ago
Alternatives and similar repositories for acltoolkit:
Users that are interested in acltoolkit are comparing it to the libraries listed below
- ☆116Updated last year
- ☆157Updated 4 months ago
- A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine.☆127Updated last year
- The BackupOperatorToolkit contains different techniques allowing you to escalate from Backup Operator to Domain Admin☆169Updated 2 years ago
- Investigation about ACL abusing for Active Directory Certificate Services (AD CS)☆120Updated 3 years ago
- C# POC to extract NetNTLMv1/v2 hashes from ETW provider☆252Updated last year
- Determine if the WebClient Service (WebDAV) is running on a remote system☆125Updated last year
- Automated exploitation of MSSQL servers at scale☆106Updated last month
- PoC to coerce authentication from Windows hosts using MS-WSP☆230Updated last year
- ADCS cert template modification and ACL enumeration☆135Updated last year
- ☆79Updated last year
- C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps☆135Updated 7 months ago
- A C# tool to output crackable DPAPI hashes from user MasterKeys☆132Updated 5 months ago
- A RunAs clone with the ability to specify the password as an argument.☆111Updated last year
- Uses rpcdump to locate the ADCS server, and identify if ESC8 is vulnerable from unauthenticated perspective.☆79Updated 5 months ago
- Use ESC1 to perform a makeshift DCSync and dump hashes☆203Updated last year
- Lateral Movement☆123Updated last year
- A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY☆80Updated 3 years ago
- ☆147Updated last month
- ☆95Updated last year
- Proof of Concept Utilities Developed to Research NTLM Relaying Attacks Targeting ADFS☆176Updated 2 years ago
- Some scripts to support with importing large datasets into BloodHound☆79Updated last year
- ☆222Updated 10 months ago
- Beacon Object File & C# project to check LDAP signing☆184Updated 7 months ago
- Retrieve AD accounts description and search for password in it☆83Updated 2 years ago
- A Python POC for CRED1 over SOCKS5☆140Updated 5 months ago
- OPSEC safe Kerberoasting in C#☆190Updated 2 years ago
- A Kerberos AP-REQ hijacking tool with DNS unsecure updates abuse.☆110Updated last month
- Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel☆193Updated 2 months ago
- Python script for automating the creation of serverless cloud redirectors from Cobalt Strike malleable C2 profiles☆195Updated 8 months ago