SharpCollection

Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

Is your favorite tool missing? Feel free to open an issue or DM me on X @Flangvik Please note that Cobalt Strike's execute-assembly only accepts binaries compiled with the "Any CPU" configuration.

OpSec

Should I blindly deploy any of these binaries during real-life engagements? F*ck no, always look through anything that you deploy on a client machine or network. Eg https://github.com/dnSpyEx/dnSpy Deploying anything blindly from this repo should be reserved for Lab environments, VM's , HackTheBox, detection mapping, and so forth.

Azure DevOps?

Each night at 03:00 AM, the Azure DevOps pipeline checks for new commits to all repositories master branch. Branches with changes will be automatically fetched and compiled with different framework targets as well as architectures, before being pushed to this repo.

The pipeline can be found here: https://dev.azure.com/FlangvikDev/SharpRelease

Available builds

Legend: ✔️ = Actively built | ❌ = Not built | ⚠️ = Pipeline exists but all steps disabled

Tools marked with * have special notes — see footnotes below the table.

Some tools target specific framework versions: Certify, KrbRelay, KrbRelayUp, ShadowSpray target v4.7.2. ADCollector targets v4.6.1.

Tools \ .NET Framework	NET 4.0	NET 4.5	NET 4.7
ADCollector ¹	❌	❌	✔️
ADCSPwn	✔️	✔️	✔️
ADFSDump	✔️	✔️	✔️
ADSearch	❌	❌	✔️
AtYourService ²	✔️	✔️	✔️
BadAssMacros	❌	✔️	✔️
BetterSafetyKatz	✔️	✔️	✔️
Certify ³	❌	❌	✔️
CheeseTools ⁴	❌	❌	✔️
DeployPrinterNightmare	✔️	✔️	✔️
EDD	✔️	✔️	✔️
Evasor ²	✔️	✔️	✔️
Farmer	❌	❌	✔️
ForgeCert	❌	✔️	✔️
GMSAPasswordReader	❌	❌	✔️
Group3r	❌	✔️	✔️
Grouper2	✔️	✔️	✔️
Internal-Monologue	✔️	✔️	✔️
InveighZero	⚠️	⚠️	⚠️
KrbRelay ³	❌	❌	✔️
KrbRelayUp ³	❌	❌	✔️
LockLess	✔️	✔️	✔️
Moriarty	❌	✔️	✔️
PassTheCert	✔️	✔️	✔️
PurpleSharp	❌	✔️	✔️
Rubeus	✔️	✔️	✔️
RunasCs	✔️	✔️	✔️
SafetyKatz	✔️	✔️	✔️
SauronEye	❌	❌	✔️
Scout ⁷	✔️	✔️	✔️
SearchOutlook	✔️	✔️	✔️
SharpSCOM ³	❌	❌	✔️
Seatbelt	✔️	❌	✔️
ShadowSpray ³	❌	❌	✔️
Sharp-SMBExec	✔️	✔️	✔️
SharpADWS	❌	❌	✔️
SharpAllowedToAct	✔️	✔️	✔️
SharpAppLocker	❌	✔️	✔️
SharpBlock ⁵	✔️	✔️	❌
SharpBypassUAC	✔️	✔️	✔️
SharpChisel	✔️	✔️	✔️
SharpChrome	✔️	✔️	✔️
SharpChromium	✔️	✔️	✔️
SharpCloud	✔️	✔️	✔️
SharpCOM	✔️	✔️	✔️
SharpCookieMonster	✔️	✔️	✔️
SharpCrashEventLog	✔️	✔️	✔️
SharpDir	✔️	✔️	✔️
SharpDoor ⁶	✔️	✔️	✔️
SharpDPAPI	✔️	✔️	✔️
SharpDump	✔️	✔️	✔️
SharpEDRChecker	✔️	✔️	✔️
SharpExec	✔️	✔️	✔️
SharPersist	✔️	✔️	✔️
SharpFiles	✔️	✔️	✔️
SharpFinder	✔️	✔️	✔️
SharpGPOAbuse	✔️	✔️	✔️
SharpHandler	✔️	✔️	✔️
SharpHose	❌	✔️	✔️
SharpHound	❌	❌	✔️
SharpKatz	✔️	✔️	✔️
SharpKiller	❌	✔️	✔️
SharpLaps	✔️	✔️	✔️
SharpMapExec	✔️	✔️	✔️
SharpMiniDump	✔️	✔️	✔️
SharpMove	✔️	✔️	✔️
SharpNamedPipePTH	✔️	✔️	✔️
SharpNoPSExec	❌	❌	✔️
SharpPrinter	❌	✔️	✔️
SharpRDP	❌	✔️	✔️
SharpReg	✔️	✔️	✔️
SharpSCCM	❌	❌	✔️
SharpSearch	✔️	✔️	✔️
SharpSecDump	✔️	✔️	✔️
SharpShares	✔️	✔️	✔️
SharpSMBSpray	✔️	✔️	✔️
SharpSphere	❌	✔️	✔️
SharpSpray	✔️	✔️	✔️
SharpStay	✔️	✔️	✔️
SharpSuccessor	✔️	✔️	✔️
SharpSvc	❌	❌	✔️
SharpSystemTriggers ⁸	⚠️	⚠️	⚠️
SharpSniper	✔️	✔️	✔️
SharpSQLPwn	✔️	✔️	✔️
SharpTask	✔️	✔️	✔️
SharpTokenFinder	❌	✔️	✔️
SharpUp	✔️	✔️	✔️
SharpView	❌	✔️	✔️
SharpWMI	✔️	✔️	✔️