Rob

Invoke-ADEnum. Active Directory Auditing and Enumeration

Amnesiac. Amnesiac is a post-exploitation framework entirely written in PowerShell and designed to assist with lateral movement within Active Directory environments

Invoke-SessionHunter. Retrieve and display information about active user sessions on remote computers. No admin privileges required.

Invoke-SMBRemoting. Interactive Shell and Command Execution over Named-Pipes (SMB) for Fileless lateral movement

SessionExec. Execute commands in other Sessions

PPLKiller. Tool to bypass LSA Protection (aka Protected Process Light)

PowerDACL. A tool to abuse weak permissions of Active Directory Discretionary Access Control Lists (DACLs) and Access Control Entries (ACEs)

ShellGen. PowerShell script to generate ShellCode in various formats

Tools. PowerShell

Sh3ller. Sh3ller is a lightweight C2 framework in its simplest form.

KeyCredentialLink. Add Shadow Credentials to a target object by editing their msDS-KeyCredentialLink attribute

Invoke-ShareHunter. Enumerate the Domain for Readable and Writable Shares

Find-LocalAdminAccess. Check the Domain for Local Admin Access

Invoke-RunAsSystem. A simple script to elevate current session to SYSTEM (needs to be run as Administrator)

Invoke-SMBTakeover. Unbind port 445/tcp on Windows

PassSpray. Domain Password Spray

Token-Impersonation. Make or Steal a Token

Invoke-WMIRemoting. Command Execution or Pseudo-Shell over WMI

CheckSMBSigning. Checks for SMB signing disabled on all hosts in the network

JRecon. A tool to automate Active Directory Enumeration

CheckReachableHosts. Check what hosts are reachable (SMB, WMI, WinRM, or specified port)

Invoke-GrabTheHash. Get the NTLM Hash for the User or Machine Account TGT held in your current session

Validate-Credentials. Validate Domain Credentials

ADQuery. Query Active Directory Objects, GPOs, OUs, Groups

Invoke-s4u2self. A tool that abuses s4u2self to gain access to remote hosts

GZipExec. Execute commands provided as a GZip string

CheckWebDAVStatus. Check for WebDAV Service Status

TGT_Monitor. Monitor for TGTs

Invoke-ShadowHunter. Automate accounts takeover by abusing GenericWrite/GenericAll rights to add Shadow Credentials

PS2EXE. Convert Powershell scripts to EXEs

Enum-CertTemplates. Enumerate for and list Certificate Templates

JBreach. PowerShell

Collect-ADObjects. Collect Active Directory Objects

GetSystem-LCI. GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstaller.

CredsManager. A tool designed for efficient organisation and secure storage of credentials gathered during penetration tests

JMove. Lateral Movement within Windows environments

File-Server. A simple TCP file server

Get-DNSRecords. Queries DNS records from the Active Directory domain, specifically from the DNS zones stored in the Active Directory.

VBAFormat. Format long strings to VBA code

SQL-Query. MSSQL Servers Access Enumeration

SimpleSocks. A PowerShell SOCKS5 proxy that accepts connections on 127.0.0.1 and pushes them out into whatever networks the host can reach.

Ask4Creds. Prompt User for credentials

Invoke-DNSResolve. A simple script meant to speed-up the process of resolving IP ranges to hostnames

Set-DomainObject. Modify or clear a property for a specified active directory object

PsMapExec. A PowerShell tool that takes strong inspiration from CrackMapExec.