Tools

nettitude/poshc2_old

Powershell C2 Server and Implants

praetorian-inc/portbender

TCP Port Redirection Utility

punk-security/smbeagle

SMBeagle - Fileshare auditing tool.

yaxser/cobaltstrike-bof

Collection of beacon BOF written to learn windows and cobaltstrike

pwn1sher/wmeye

Fileless lateral movement tool using WMI Event Filters and MSBuild execution to deploy shellcode on remote Windows systems via LogFileEventConsumer.

justicerage/ffm

Freedom Fighting Mode: open source hacking harness

klezvirus/driverjack

Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths

frkngksl/nimexec

Fileless Command Execution for Lateral Movement in Nim

sensepost/impersonate

A windows token impersonation tool

sud0woodo/dcomrade

Powershell script for enumerating vulnerable DCOM Applications

skelsec/evilrdp

RDP client with extended control for automated mouse, keyboard, and clipboard manipulation, file transfer, SOCKS proxy, and remote command execution…

3lp4tr0n/sessionhop

Windows Session Hijacking via COM

jsitech/relayer

SMB Relay Attack Script

3lp4tr0n/remotemonologue

Weaponizing DCOM for NTLM Authentication Coercions

xforcered/sqlrecon

A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

xforcered/remotemonologue

Weaponizing DCOM for NTLM Authentication Coercions

iomoath/sharpstrike

A Post exploitation tool written in C# uses either CIM or WMI to query remote systems.

icyguider/moreimpacketexamples

More examples using the Impacket library designed for learning purposes.