APT-GUID

Project Introduction

Organizing materials in the APT field, covering but not limited to the following aspects

• APT attack tools

• APT analysis reports

• APT attack techniques

Tool Collection

Information Gathering

Active Intelligence Gathering

• EyeWitness can take screenshots of websites, provide some server information, and identify default credentials where possible https://github.com/ChrisTruncer/EyeWitness
• AWSBucketDump a tool for quickly enumerating AWS S3 Buckets to look for loot https://github.com/jordanpotti/AWSBucketDump
• AQUATONE is a tool for performing information gathering on domains https://github.com/michenriksen/aquatone
• Spoofcheck, used to check whether a domain can be spoofed; the program checks SPF and DMARC records for weak configurations that allow spoofing https://github.com/BishopFox/spoofcheck
• Nmap used to discover hosts and services on a computer network https://github.com/nmap/nmap
• dnsrecon is a DNS enumeration script https://github.com/darkoperator/dnsrecon
• dirsearch is a simple command-line tool to brute-force website directories https://github.com/maurosoria/dirsearch
• Sn1per is an automated penetration testing tool https://github.com/1N3/Sn1per

Passive Intelligence Gathering

• Social Mapper OSINT social media mapping tool that takes a list of usernames and images (or LinkedIn company names) and performs large-scale automated target searches across multiple social media sites. Not limited by APIs because it uses Selenium. https://github.com/SpiderLabs/social_mapper
• skiptracer OSINT exploitation framework https://github.com/xillwillx/skiptracer
• FOCA mainly used to find metadata and hidden information in scanned documents. https://github.com/ElevenPaths/FOCA
• theHarvester used to collect subdomains, email addresses, virtual hosts, ports/banners, and employee names from different public sources. https://github.com/laramies/theHarvester
• Metagoofil is a tool for extracting metadata from public documents (pdf, doc, xls, ppt, etc.) available on target websites. https://github.com/laramies/metagoofil
• SimplyEmail email reconnaissance. https://github.com/killswitch-GUI/SimplyEmail
• truffleHog searches git repositories for sensitive data, digging deep into commit history and branches. https://github.com/dxa4481/truffleHog
• Just-Metadata a tool for collecting and analyzing metadata about IP addresses. It tries to find relationships between systems in large datasets. https://github.com/ChrisTruncer/Just-Metadata
• typofinder shows the country/region where an IP address is located. https://github.com/nccgroup/typofinder
• pwnedOrNot is a python script that checks whether an email account has been compromised in a data breach; if the email account has been compromised, it continues to find passwords for that account. https://github.com/thewhiteh4t/pwnedOrNot
• GitHarvester this tool is used to gather information from GitHub, such as google dorks. https://github.com/metac0rtex/GitHarvester

Exploitation

• WinRAR Remote Code Execution Proof of Concept exploit for CVE-2018-20250. https://github.com/WyAtu/CVE-2018-20250
• Composite Moniker Proof of Concept exploit for CVE-2017-8570. https://github.com/rxwx/CVE-2017-8570
• Exploit toolkit CVE-2017-8759 https://github.com/bhdresh/CVE-2017-8759
• CVE-2017-11882 Exploit https://github.com/unamer/CVE-2017-11882
• Adobe Flash Exploit CVE-2018-4878. https://github.com/anbai-inc/CVE-2018-4878
• Exploit toolkit CVE-2017-0199 is a convenient python script that provides penetration testers and security researchers with a quick and effective way to test Microsoft Office RCE. https://github.com/bhdresh/CVE-2017-0199
• demiguise HTA encryption tool https://github.com/nccgroup/demiguise
• Office-DDE-Payloads collection of scripts and templates that generate Office documents embedded with DDE (macro-free command execution technique). https://github.com/0xdeadbeefJERKY/Office-DDE-Payloads
• CACTUSTORCH payload generation for adversary simulation. https://github.com/mdsecactivebreach/CACTUSTORCH
• SharpShooter is a payload creation framework for executing arbitrary CSharp source code. https://github.com/mdsecactivebreach/SharpShooter
• DKMC, a tool that generates obfuscated shellcode stored in images. The image is 100% valid and 100% valid shellcode. https://github.com/Mr-Un1k0d3r/DKMC
• Malicious Macro Generator used to generate obfuscated macros, which also include AV/sandbox evasion mechanisms. https://github.com/Mr-Un1k0d3r/MaliciousMacroGenerator

Social Engineering Phishing

• King Phisher https://github.com/securestate/king-phisher
• FiercePhish https://github.com/Raikia/FiercePhish
• ReelPhish https://github.com/fireeye/ReelPhish/
• Gophish https://github.com/gophish/gophish
• CredSniper https://github.com/ustayready/CredSniper
• PwnAuth https://github.com/fireeye/PwnAuth
• Phishing Frenzy https://github.com/pentestgeek/phishing-frenzy
• Phishing Pretexts https://github.com/L4bF0x/PhishingPretexts
• Modlishka https://github.com/drk1wi/Modlishka
• Evilginx2 https://github.com/kgretzky/evilginx2

C2 Frameworks

• Cobalt Strike https://cobaltstrike.com/

• Empire https://github.com/EmpireProject/Empire

• Metasploit Framework https://github.com/rapid7/metasploit-framework

• SILENTTRINITY https://github.com/byt3bl33d3r/SILENTTRINITY

• Pupy https://github.com/n1nj4sec/pupy

• Koadic https://github.com/zerosum0x0/koadic

• PoshC2 https://github.com/nettitude/PoshC2_Python

• Gcat https://github.com/byt3bl33d3r/gcat

• TrevorC2 https://github.com/trustedsec/trevorc2

• Merlin https://github.com/Ne0nd0g/merlin

• Quasar https://github.com/quasar/QuasarRAT

• Covenant https://github.com/cobbr/Covenant

• FactionC2 https://github.com/FactionC2/

• DNScat2 https://github.com/iagox86/dnscat2

• Sliver https://github.com/BishopFox/sliver

• EvilOSX

Post-Exploitation

• CrackMapExec https://github.com/byt3bl33d3r/CrackMapExec
• PowerLessShell https://github.com/Mr-Un1k0d3r/PowerLessShell
• GoFetch automates execution of attack plans generated by BloodHound. https://github.com/GoFetchAD/GoFetch
• ANGRYPUPPY bloodhound attack path automation in CobaltStrike. https://github.com/vysec/ANGRYPUPPY
• DeathStar https://github.com/byt3bl33d3r/DeathStar
• SharpHound https://github.com/BloodHoundAD/SharpHound
• BloodHound.py is a Python-based BloodHound ingestor based on Impacket. https://github.com/fox-it/BloodHound.py
• Responder man-in-the-middle attack tool https://github.com/SpiderLabs/Responder
• SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. https://github.com/fireeye/SessionGopher
• PowerSploit PowerShell toolset https://github.com/PowerShellMafia/PowerSploit
• Nishang https://github.com/samratashok/nishang
• Inveigh man-in-the-middle attack tool https://github.com/Kevin-Robertson/Inveigh
• PowerUpSQL a PowerShell Toolkit for Attacking SQL Server. https://github.com/NetSPI/PowerUpSQL
• MailSniper https://github.com/dafthack/MailSniper

Network Proxy

• Tunna used to bypass network restrictions in firewall environments https://github.com/SECFORCE/Tunna
• reGeorg socks proxy tool https://github.com/sensepost/reGeorg
• Blade Webshell management tool https://github.com/wonderqs/Blade
• TinyShell Web Shell framework. https://github.com/threatexpress/tinyshell
• PowerLurk PowerShell toolset for building malicious WMI. https://github.com/Sw4mpf0x/PowerLurk
• DAMP persistence through host-based security descriptor modification https://github.com/HarmJ0y/DAMP

Privilege Escalation

In-Domain Privilege Escalation

• PowerView https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
• Get-GPPPassword https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1
• Invoke-ACLpwn https://github.com/fox-it/Invoke-ACLPwn
• BloodHound https://github.com/BloodHoundAD/BloodHound
• PyKEK https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek
• Grouper a tool for automatically finding Group Policy vulnerabilities https://github.com/l0ss/Grouper
• ADRecon https://github.com/sense-of-security/ADRecon
• ADACLScanner https://github.com/canix1/ADACLScanner
• ACLight used to discover privileged accounts that can be targeted in the domain - including Shadow Admins. https://github.com/cyberark/ACLight
• LAPSToolkit https://github.com/leoloobeek/LAPSToolkit
• PingCastle https://www.pingcastle.com/download
• RiskySPNs is a collection of PowerShell scripts focused on detecting and querying accounts associated with SPNs (Service Principal Names). https://github.com/cyberark/RiskySPN
• Mystique is a PowerShell tool that works with the Kerberos S4U extension. This module assists blue teams in identifying dangerous Kerberos delegation configurations and red teams in impersonating any user by combining KCD with protocol transition. https://github.com/machosec/Mystique

Linux Privilege Escalation

• https://github.com/Al1ex/Heptagram/tree/master/Linux/Elevation Linux privilege escalation collection
• https://github.com/AlessandroZ/BeRoot py, finds privilege escalation methods by checking common misconfigurations. Supports Windows/Linux/Mac
• https://github.com/mschwager/0wned uses python packages for high-privilege user creation
• https://github.com/mzet-/linux-exploit-suggester script to find which patches are missing on Linux
• https://github.com/belane/linux-soft-exploit-suggester find vulnerable software on Linux
• https://github.com/dirtycow/dirtycow.github.io Dirty COW privilege escalation exploit
• https://github.com/FireFart/dirtycow Dirty COW privilege escalation exploit
• https://github.com/stanleyb0y/sushell uses su thief to allow low-privileged users to steal root passwords
• https://github.com/jas502n/CVE-2018-17182/ Linux kernel VMA-UAF privilege escalation vulnerability CVE-2018-17182
• https://github.com/jas502n/CVE-2018-14665 CVE-2018-14665, Xorg X server privilege escalation exploit on Linux
• https://github.com/nmulasmajic/syscall_exploit_CVE-2018-8897 Linux privilege escalation using Syscall
• https://github.com/can1357/CVE-2018-8897 Linux privilege escalation using Syscall
• https://github.com/SecWiki/linux-kernel-exploits linux-kernel-exploits collection of Linux platform privilege escalation vulnerabilities
• https://github.com/nilotpalbiswas/Auto-Root-Exploit Linux automatic privilege escalation script
• https://github.com/WazeHell/PE-Linux Linux privilege escalation tool

Windows Privilege Escalation

• https://github.com/Al1ex/Heptagram/tree/master/Windows/Elevation Windows privilege escalation collection
• http://www.fuzzysecurity.com/tutorials/16.html Windows platform tutorial-level privilege escalation reference article
• https://github.com/SecWiki/windows-kernel-exploits Windows platform privilege escalation exploit collection
• https://github.com/51x/WHP various privilege escalation and exploitation tools for Windows
• https://github.com/rasta-mouse/Sherlock Windows privilege escalation vulnerability verification
• https://github.com/WindowsExploits/Exploits Microsoft CVE-2012-0217, CVE-2016-3309, CVE-2016-3371, CVE-2016-7255, CVE-2017-0213 privilege escalation exploits
• https://github.com/decoder-it/lonelypotato RottenPotatoNG variant, uses NBNS local domain spoofing and WPAD proxy spoofing for privilege escalation
• https://github.com/ohpe/juicy-potato RottenPotatoNG variant, uses COM objects and user tokens for privilege escalation
• https://github.com/foxglovesec/Potato RottenPotatoNG variant, uses local domain spoofing and proxy spoofing for privilege escalation
• https://github.com/DanMcInerney/icebreaker if you are in an intranet environment but outside the AD environment, icebreaker will help you obtain plaintext Active Directory credentials (Active Directory stored on domain controllers can be used for privilege escalation)
• https://github.com/hausec/ADAPE-Script Active Directory privilege escalation script
• https://github.com/klionsec/BypassAV-AllThings use ASPX one-liner combined with privilege escalation payloads
• https://github.com/St0rn/Windows-10-Exploit msf plugin, win10 uac bypass
• exploits Win32k.sys kernel vulnerability for elevation, ms14-058

Data Exfiltration

• CloakifyFactory & the Cloakify Toolset - https://github.com/TryCatchHCF/Cloakify
• DET (is provided AS IS), is a POC that performs data exfiltration over single or multiple channels at the same time. https://github.com/sensepost/DET
• DNSExfiltrator . https://github.com/Arno0x/DNSExfiltrator
• PyExfil a Python Package for Data Exfiltration. https://github.com/ytisf/PyExfil
• Egress-Assess is a tool for testing egress data detection capabilities. https://github.com/ChrisTruncer/Egress-Assess
• Powershell RAT a Python-based backdoor that uses Gmail to transmit data as email attachments. https://github.com/Viralmaniar/Powershell-RAT

Other

Adversary Simulation

• MITRE CALDERA simulates adversary attack techniques and analyzes them https://github.com/mitre/caldera
• APTSimulator https://github.com/NextronSystems/APTSimulator
• Atomic Red Team - https://github.com/redcanaryco/atomic-red-team
• Network Flight Simulator https://github.com/alphasoc/flightsim
• Metta - https://github.com/uber-common/metta
• Red Team Automation (RTA) - RTA provides a scripting framework that allows blue teams to model against MITER ATT&CK and test their detection capabilities against malicious tools. https://github.com/endgameinc/RTA

Wireless Attacks

• Wifiphisher WiFi automatic association attack tool. https://github.com/wifiphisher/wifiphisher
• mana man-in-the-middle attack. https://github.com/sensepost/mana

Embedded Attacks- magspoof https://github.com/samyk/magspoof

• WarBerryPi https://github.com/secgroundzero/warberry
• P4wnP1 https://github.com/mame82/P4wnP1
• malusb https://github.com/ebursztein/malusb
• Fenrir https://github.com/Orange-Cyberdefense/fenrir-ocd
• poisontap https://github.com/samyk/poisontap
• WHID https://github.com/whid-injector/WHID
• PhanTap https://github.com/nccgroup/phantap

Communication Covertness

• RocketChat https://rocket.chat
• Etherpad https://etherpad.org/

Log Management

• RedELK https://github.com/outflanknl/RedELK/
• CobaltSplunk https://github.com/vysec/CobaltSplunk
• Red Team Telemetry https://github.com/ztgrace/red_team_telemetry
• Elastic for Red Teaming https://github.com/SecurityRiskAdvisors/RedTeamSIEM
• Ghostwriter https://github.com/GhostManager/Ghostwriter

C# Weaponization

• SharpSploit .NET post-exploitation framework https://github.com/cobbr/SharpSploit
• GhostPack Csharp toolset https://github.com/GhostPack
• SharpWeb Reads common browser passwords https://github.com/djhohnstein/SharpWeb
• reconerator https://github.com/stufus/reconerator
• SharpView C# version of PowerView. https://github.com/tevora-threat/SharpView
• Watson https://github.com/rasta-mouse/Watson

LABS

• Detection Lab Automatically build a lab https://github.com/clong/DetectionLab ---Five-star recommendation
• Modern Windows Attacks and Defense Labhttps://github.com/jaredhaight/WindowsAttackAndDefenseLab
• Invoke-UserSimulator https://github.com/ubeeri/Invoke-UserSimulator
• Invoke-ADLabDeployer Automatically deploy AD environment https://github.com/outflanknl/Invoke-ADLabDeployer
• Sheepl https://github.com/SpiderLabs/sheepl

Script

Aggressor Scripts

• https://github.com/invokethreatguy/CSASC
• https://github.com/secgroundzero/CS-Aggressor-Scripts
• https://github.com/Und3rf10w/Aggressor-scripts
• https://github.com/harleyQu1nn/AggressorScripts
• https://github.com/rasta-mouse/Aggressor-Script
• https://github.com/RhinoSecurityLabs/Aggressor-Scripts
• https://github.com/bluscreenofjeff/AggressorScripts
• https://github.com/001SPARTaN/aggressor_scripts
• https://github.com/360-A-Team/CobaltStrike-Toolset
• https://github.com/FortyNorthSecurity/AggressorAssessor
• https://github.com/ramen0x3f/AggressorScripts

Red-Team

• https://github.com/FuzzySecurity/PowerShell-Suite
• https://github.com/nettitude/Powershell
• https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts
• https://github.com/threatexpress/red-team-scripts
• https://github.com/SadProcessor/SomeStuff
• https://github.com/rvrsh3ll/Misc-Powershell-Scripts
• https://github.com/enigma0x3/Misc-PowerShell-Stuff
• https://github.com/ChrisTruncer/PenTestScripts
• https://github.com/bluscreenofjeff/Scripts
• https://github.com/xorrior/RandomPS-Scripts
• https://github.com/xorrior/Random-CSharpTools
• https://github.com/leechristensen/Random
• https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/social-engineering