Obfuscated SharpCollection

Quick and dirty stab at automated Obfuscation using yetAnotherObfuscator by @0xcc00 together with fresh builds of common C# offensive tools, in a CDI fashion using Azure DevOps release pipelines.

Obfuscated SharpCollection is not intended to be as complete as the original SharpCollection repo. Obfuscated SharpCollection only contains obfuscated NetFramework 4.7 ANY_CPU compiled binaries

Azure DevOps?

Each night at 03:00 AM, the Azure DevOps pipeline checks for new commits to all repositories master branch. Branches with changes will be automatically fetched and compiled with different framework targets as well as architectures, before being pushed to this repo.

The pipeline can be found here: https://dev.azure.com/FlangvikDev/SharpRelease

OpSec

Should I blindly deploy any of these binaries during real-life engagements?
F*ck no, always look through anything that you deploy on a client machine or network. Eg https://github.com/dnSpy/dnSpy
Deploying anything blindly from this repo should be reserved for Lab environment, VM's , HTB, detection mapping, and so forth.

Available builds

Sources / Credits

Links for all these amazing tools are below :) title @leechristensen

• ADCollector - C# tool to quickly extract valuable information from the Active Directory environment @dev-2null
• ADCSPwn - C# tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service. @bats3c
• ADSearch - C# tool to help query AD via the LDAP protocol @tomcarver16 (Only NET 4.7)
• ADFSDump - A C# tool to dump all sorts of goodies from AD FS. @FireEye
• AtYourService - C# .NET Assembly for Service Enumeration @mitchmoser
• BetterSafetyKatz - Fork of SafetyKatz dynamically fetches the latest Mimikatz, runtime patching signatures and PE loads Mimikatz into memory. @Flangvik
• Certify - C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS). @harmj0y @tifkin_
• EDD - Enumerate Domain Data is designed to be similar to PowerView but in .NET @FortyNorthSecurity
• ForgeCert - uses a stolen CA certificate + private key to forge certificates for arbitrary users. @tifkin_
• DeployPrinterNightmare - C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc @Flangvik
• Grouper2 - C# tool to help find security-related misconfigurations in Active Directory Group Policy. @mikeloss
• Group3r - C# tool to find vulnerabilities in AD Group Policy, but do it better than Grouper2 did. @mikeloss
• KrbRelay - C# Framework for Kerberos relaying @cube0x0
• KrbRelayUp - universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced @dec0ne