nccgroup/gtfoblookupOffline command line lookup utility for GTFOBins (https://github.com/GTFOBins/GTFOBins.github.io), LOLBAS (https://github.com/LOLBAS-Project/LOLBAS), WADComs (https://wadcoms.github.io), and HijackLibs (https://hijacklibs.net/).
GTFOBins, LOLBAS, WADComs, HijackLibs를 위한 오프라인 커맨드라인 조회 유틸리티입니다.
GTFOBLookup은 Python2.7에서도 실행되지만, 일부 기능은 Python3가 필요합니다.
GTFOBLookup에는 다음 비표준 Python 라이브러리를 설치해야 합니다:
pip install appdirs)pip install colorama)pip install gitpython)pip install pyyaml)다음 명령어로 모두 설치할 수 있습니다: pip install -r requirements.txt
pipx를 사용하여 GTFOBLookup을 설치하는 것이 좋습니다:
pipx install git+https://github.com/nccgroup/GTFOBLookup.git
설치가 완료되면 인터넷에 연결된 상태에서 gtfoblookup.py update를 실행하여 저장소의 로컬 복사본을 다운로드하세요.
Linux에서 GTFOBLookup 디렉터리로 이동한 후 man ./gtfoblookup.1을 실행하거나 아래를 참조하세요:
gtfoblookup.py [-h] {update,purge,gtfobins,lolbas,wadcoms,hijacklibs} ...
OPTIONS
Sub-commands
gtfoblookup.py update
update local copies of repositories
gtfoblookup.py purge
remove local copies of repositories
gtfoblookup.py gtfobins
search the local copy of GTFOBins
gtfoblookup.py lolbas
search the local copy of LOLBAS
gtfoblookup.py wadcoms
search the local copy of WADComs
gtfoblookup.py hijacklibs
search the local copy of HijackLibs
OPTIONS 'gtfoblookup.py update'
usage: gtfoblookup.py update [-h] [-r repo]
-r repo, --repo repo
Only update the specified repository
OPTIONS 'gtfoblookup.py purge'
usage: gtfoblookup.py purge [-h] [-r repo]
-r repo, --repo repo
Only delete the specified repository
OPTIONS 'gtfoblookup.py gtfobins'
usage: gtfoblookup.py gtfobins [-h] {list,search} ...
Sub-commands
gtfoblookup.py gtfobins list
list all types/categories/executables/prerequisites/services/attack types/OSs featured in the local copy of GTFOBins
gtfoblookup.py gtfobins search
searchthe GTFOBins repository
OPTIONS 'gtfoblookup.py gtfobins list'
usage: gtfoblookup.py gtfobins list [-h] attribute
attribute
the attribute to list
OPTIONS 'gtfoblookup.py gtfobins search'
usage: gtfoblookup.py gtfobins search [-h] [-c categories] [-f] executable
executable
the executable to search for
-c categories, --category categories
category or categories (comma separated) to search in
-f, --file
use a file containing a list of executables (one per line) instead of a single executable
OPTIONS 'gtfoblookup.py lolbas'
usage: gtfoblookup.py lolbas [-h] {list,search} ...
Sub-commands
gtfoblookup.py lolbas list
list all types/categories/executables/prerequisites/services/attack types/OSs featured in the local copy of LOLBAS
gtfoblookup.py lolbas search
searchthe LOLBAS repository
OPTIONS 'gtfoblookup.py lolbas list'
usage: gtfoblookup.py lolbas list [-h] attribute
attribute
the attribute to list
OPTIONS 'gtfoblookup.py lolbas search'
usage: gtfoblookup.py lolbas search [-h] [-c categories] [-t types] [-f]
executable
executable
the executable to search for
-c categories, --category categories
category or categories (comma separated) to search in
-t types, --type types
type or types (comma separated)of executable to search for
-f, --file
use a file containing a list of executables (one per line) instead of a single executable
OPTIONS 'gtfoblookup.py wadcoms'
usage: gtfoblookup.py wadcoms [-h] {list,search} ...
Sub-commands
gtfoblookup.py wadcoms list
list all types/categories/executables/prerequisites/services/attack types/OSs featured in the local copy of WADComs
gtfoblookup.py wadcoms search
searchthe WADComs repository
OPTIONS 'gtfoblookup.py wadcoms list'
usage: gtfoblookup.py wadcoms list [-h] attribute
attribute
the attribute to list
OPTIONS 'gtfoblookup.py wadcoms search'
usage: gtfoblookup.py wadcoms search [-h] [-p prerequisites] [-s services]
[-a attack_types] [-o OSs] [-f]
executable
executable
the executable to search for
-p prerequisites, --prereq prerequisites
search for executables with a specific prerequisite or prerequisites (comma separated)
-s services, --service services
search for executables that interract with aspecific service or services(comma separated)
-a attack_types, --attacktype attack_types
search for executables that can be used for aspecific type or types (comma separated) of attacks
-o OSs, --os OSs
search for executables that can be run on a specific operating system oroperating systems (comma separated)
-f, --file
use a file containing a list of executables (one per line) instead of a single executable
OPTIONS 'gtfoblookup.py hijacklibs'
usage: gtfoblookup.py hijacklibs [-h] {list,search} ...
Sub-commands 'gtfoblookup.py hijacklibs'
gtfoblookup.py hijacklibs list
list all types/categories/executables/prerequisites/services/attack types/OSs featured in the local copy of HijackLibs
gtfoblookup.py hijacklibs search
searchthe HijackLibs repository
OPTIONS 'gtfoblookup.py hijacklibs list'
usage: gtfoblookup.py hijacklibs list [-h] attribute
attribute
the attribute to list
Sub-commands 'gtfoblookup.py hijacklibs search'
usage: gtfoblookup.py hijacklibs search [-h] [-a attack_types] [-v vendors] [-f] executable
executable
the executable to search for (use "all" to show results for all executables)
OPTIONS 'gtfoblookup.py hijacklibs search'
-a attack_types, --attacktype attack_types
search for executables that can be used for aspecific type or types (comma separated) of attacks
-v vendors, --vendor vendors
search for executables from a specific vendor or vendors (comma separated)
-f, --file
use a file containing a list of executables (one per line) instead of a single executable