flangvik/obfuscatedsharpcollectionVersuch einer verschleierten Version von SharpCollection
Schneller, unkomplizierter Versuch einer automatisierten Verschleierung mit yetAnotherObfuscator von @0xcc00 zusammen mit frischen Builds gängiger C#-Offensivtools, im CDI-Stil mithilfe von Azure DevOps-Release-Pipelines.
Obfuscated SharpCollection erhebt nicht den Anspruch, so vollständig zu sein wie das ursprüngliche SharpCollection-Repository. Obfuscated SharpCollection enthält ausschließlich verschleierte, für NetFramework 4.7 ANY_CPU kompilierte Binärdateien
Jede Nacht um 03:00 Uhr prüft die Azure DevOps-Pipeline den Master-Branch aller Repositorys auf neue Commits. Branches mit Änderungen werden automatisch abgerufen und mit verschiedenen Framework-Zielen sowie Architekturen kompiliert, bevor sie in dieses Repository gepusht werden.
Die Pipeline ist hier zu finden: https://dev.azure.com/FlangvikDev/SharpRelease
Sollte ich eine dieser Binärdateien bei realen Einsätzen blind einsetzen?
F*ck nein, schau dir immer alles an, was du auf einem Client-Rechner oder Netzwerk einsetzt. Z. B. https://github.com/dnSpy/dnSpy
Das blinde Einsetzen von irgendetwas aus diesem Repository sollte Laborumgebungen, VMs, HTB, Detection-Mapping usw. vorbehalten sein.
| Tools \ .NET Framework | NET 4.0 | NET 4.5 | NET 4.7 |
|---|---|---|---|
| ADCollector | ✔️ | ✔️ | ✔️ |
| ADCSPwn | ✔️ | ✔️ | ✔️ |
| ADSearch | ❌ | ❌ | ✔️ |
| ADFSDump | ✔️ | ✔️ | ✔️ |
| AtYourService | ✔️ | ✔️ | ✔️ |
| BetterSafetyKatz | ✔️ | ✔️ | ✔️ |
| Certify | ✔️ | ✔️ | ✔️ |
| EDD | ✔️ | ✔️ | ✔️ |
| ForgeCert | ❌ | ✔️ | ✔️ |
| DeployPrinterNightmare | ✔️ | ✔️ | ✔️ |
| Grouper2 | ✔️ | ✔️ | ✔️ |
| Group3r | ❌ | ✔️ | ✔️ |
| KrbRelay | ❌ | ❌ | ✔️ |
| KrbRelayUp | ❌ | ❌ | ✔️ |
| InveighZero | ✔️ | ✔️ | ✔️ |
| LockLess | ✔️ | ✔️ | ✔️ |
| PassTheCert | ✔️ | ✔️ | ✔️ |
| PurpleSharp | ❌ | ✔️ | ✔️ |
| Rubeus | ✔️ | ✔️ | ✔️ |
| SafetyKatz | ✔️ | ✔️ | ✔️ |
| SauronEye | ❌ | ❌ | ✔️ |
| scout | ✔️ | ✔️ | ✔️ |
| SearchOutlook | ✔️ | ✔️ | ✔️ |
| Seatbelt | ✔️ | ✔️ | ✔️ |
| Sharp-SMBExec | ✔️ | ✔️ | ✔️ |
| SharpAllowedToAct | ✔️ | ✔️ | ✔️ |
| SharpAppLocker | ❌ | ✔️ | ✔️ |
| SharpBlock | ✔️ | ✔️ | ✔️ |
| SharpBypassUAC | ✔️ | ✔️ | ✔️ |
| SharpChisel | ✔️ | ✔️ | ✔️ |
| SharpChrome | ✔️ | ✔️ | ✔️ |
| SharpChromium | ✔️ | ✔️ | ✔️ |
| SharpCloud | ✔️ | ✔️ | ✔️ |
| SharpCOM | ✔️ | ✔️ | ✔️ |
| SharpCrashEventLog | ✔️ | ✔️ | ✔️ |
| SharpDir | ✔️ | ✔️ | ✔️ |
| SharpDoor | ✔️ | ✔️ | ✔️ |
| SharpDPAPI | ✔️ | ✔️ | ✔️ |
| SharpDump | ✔️ | ✔️ | ✔️ |
| SharpEDRChecker | ✔️ | ✔️ | ✔️ |
| SharpExec | ✔️ | ✔️ | ✔️ |
| SharPersist | ✔️ | ✔️ | ✔️ |
| SharpFiles | ✔️ | ✔️ | ✔️ |
| SharpGPOAbuse | ✔️ | ✔️ | ✔️ |
| SharpHandler | ✔️ | ✔️ | ✔️ |
| SharpHose | ❌ | ✔️ | ✔️ |
| SharpHound | ❌ | ❌ | ✔️ |
| SharpKatz | ✔️ | ✔️ | ✔️ |
| SharpLaps | ✔️ | ✔️ | ✔️ |
| SharpMapExec | ✔️ | ✔️ | ✔️ |
| SharpMiniDump | ✔️ | ✔️ | ✔️ |
| SharpMove | ✔️ | ✔️ | ✔️ |
| SharpPrinter | ❌ | ✔️ | ✔️ |
| SharpNoPSExec | ❌ | ❌ | ✔️ |
| SharpRDP | ❌ | ✔️ | ✔️ |
| SharpReg | ✔️ | ✔️ | ✔️ |
| SharpSCCM | ❌ | ❌ | ✔️ |
| SharpSecDump | ✔️ | ✔️ | ✔️ |
| SharpShares | ✔️ | ✔️ | ✔️ |
| SharpSphere | ❌ | ✔️ | ✔️ |
| SharpSpray | ✔️ | ✔️ | ✔️ |
| SharpStay | ✔️ | ✔️ | ✔️ |
| SharpSvc | ❌ | ❌ | ✔️ |
| SharpSniper | ✔️ | ✔️ | ✔️ |
| SharpSQLPwn | ✔️ | ✔️ | ✔️ |
| SharpTask | ✔️ | ✔️ | ✔️ |
| SharpUp | ✔️ | ✔️ | ✔️ |
| SharpView | ❌ | ✔️ | ✔️ |
| SharpWMI | ✔️ | ✔️ | ✔️ |
| SharpWebServer | ✔️ | ✔️ | ✔️ |
| SharpWifiGrabber | ✔️ | ✔️ | ✔️ |
| SharpZeroLogon | ✔️ | ✔️ | ✔️ |
| Shhmon | ✔️ | ✔️ | ✔️ |
| Snaffler | ❌ | ✔️ | ✔️ |
| SqlClient | ✔️ | ✔️ | ✔️ |
| StandIn | ✔️ | ✔️ | ✔️ |
| StickyNotesExtract | ✔️ | ✔️ | ✔️ |
| SweetPotato | ❌ | ✔️ | ✔️ |
| ThunderFox | ✔️ | ✔️ | ✔️ |
| TruffleSnout | ❌ | ✔️ | ✔️ |
| TokenStomp | ✔️ | ✔️ | ✔️ |
| Watson | ✔️ | ✔️ | ✔️ |
| winPEAS | ❌ | ✔️ | ✔️ |
| WMIReg | ✔️ | ✔️ | ✔️ |
| Whisker | ❌ | ❌ | ✔️ |
| Links zu all diesen großartigen Tools findest du unten :) | |||
| Titel | |||
| @leechristensen |
