usage: wmi_reg_exec.py [-h] [-f file] [-a args] [-n namespace] [-r key] [-p patch] [-rp remotePath] [-nooutput] [-H hash] [-k]
                       [-dc-ip IPAddress]
                       target

Store exe in registry and execute via powershell

positional arguments:
  target                Target host to execute file on

optional arguments:
  -h, --help            show this help message and exit
  -f file, -file file   File to execute
  -a args, -args args   Command line arguments for file
  -n namespace, -namespace namespace
                        Namespace.Class containing main method to execute (Ex: Rubeus.Program)
  -r key, -reg-key key  Registry key to write file to (Default: HKLM\Software\Microsoft\Edge)
  -p patch, -patch patch
                        File containing AMSI/ETW patch to perform before execution
  -rp remotePath, -remote-path remotePath
                        The remote path to write files to (Default: C:\Windows\Temp)
  -nooutput             Do not attempt to get/print output

authentication:
  -H hash, -hash hash   NTHash for login via PtH
  -k                    Use Kerberos authentication with credentials from the KRB5CCNAME ccache file
  -dc-ip IPAddress      IP Address of the domain controller (useful for Kerberos auth)

usage: dll_proxy_exec.py [-h] [-f file] [-e exe] [-output] [-H hash] [-k] [-dc-ip IPAddress] [-rp remotePath] target

Execute file via DLL proxying on a remote host.

positional arguments:
  target                [[domain/]username[:password]@]<hostname or address>

optional arguments:
  -h, --help            show this help message and exit
  -f file, -file file   DLL file to execute
  -e exe, -exe exe      System32 EXE used to execute DLL file
  -output               Attempt to get output
  -rp remotePath, -remote-path remotePath
                        The remote path to write files to (Default: C:\Windows\Temp)

authentication:
  -H hash, -hash hash   NTHash for login via PtH
  -k                    Use Kerberos authentication with credentials from the KRB5CCNAME ccache file
  -dc-ip IPAddress      IP Address of the domain controller (useful for Kerberos auth)

usage: remote_ssp_dump.py [-h] [-t timeout] [-rp remotePath] [-re] [-dp] [-f dll] [-e exe] [-r key] [-H hash] [-k]
                          [-dc-ip IPAddress]
                          target

Dump creds from LSASS remotely using Nanodump SSP

positional arguments:
  target                [[domain/]username[:password]@]<hostname or address>

optional arguments:
  -h, --help            show this help message and exit
  -t timeout, -timeout timeout
                        Timeout in seconds to wait for LSASS dump file to be created (Default: 3)
  -rp remotePath, -remote-path remotePath
                        The remote path to write files to (Default: C:\Windows\Temp)
  -re, -reg-exec        Execute SSP loader by writing it to the registry and executing it in memory with PowerShell
  -dp, -dll-proxy       Execute SSP loader via DLL Proxying (See below for options)

dll proxying options:
  -f dll, -file dll     DLL file to execute
  -e exe, -exe exe      System32 EXE used to execute DLL file

registry execute options:
  -r key, -reg-key key  Registry key to write file to (Default: HKLM\Software\Microsoft\Edge)

authentication:
  -H hash, -hash hash   NTHash for login via PtH
  -k                    Use Kerberos authentication with credentials from the KRB5CCNAME ccache file
  -dc-ip IPAddress      IP Address of the domain controller (useful for Kerberos auth)

usage: dump_ntds_creds.py [-h] [-nooutput] [-o filename] [-H hash] [-k] [-dc-ip IPAddress] [-rp remotePath] target

Dump NTDS.dit file, exfiltrate, and parse locally.

positional arguments:
  target                [[domain/]username[:password]@]<hostname or address>

optional arguments:
  -h, --help            show this help message and exit
  -nooutput             Do not print dumped hashes to console
  -o filename, -outfile filename
                        Name to save output files with (Default: DomainDump)
  -rp remotePath, -remote-path remotePath
                        The remote path to write files to (Default: C:\Windows\Temp)

authentication:
  -H hash, -hash hash   NTHash for login via PtH
  -k                    Use Kerberos authentication with credentials from the KRB5CCNAME ccache file
  -dc-ip IPAddress      IP Address of the domain controller (useful for Kerberos auth)