Will Schroeder

CheatSheets. Cheat sheets for various projects.

DAMP. The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification

PowerUp. This version of PowerUp is now unsupported. See https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp for the most current version.

ASREPRoast. Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.

Misc-PowerShell. Misc. PowerShell scripts

TrustVisualizer. Python script that takes new output from Get-DomainTrustMapping .csvs and outputs graphml. Based on DomainTrustExplorer.

pylnker. This is a Python port of lnk-parse-1.0, a tool to parse Windows .lnk files.

cortana. This is a pack of Cortana scripts commonly used on our pentests.

ImpDump. This is a simple parser for/decrypter for Impacket's esentutl.py utility. It assists with decrypting hashes and hash histories from ntds.dit databases.

EncryptedStore. Offensive Data Storage

Arya. Arya is a simple obfuscator for .NET binaries.

Invoke-ADDefense. Defensive-oriented Active Directory enumeration

Malleable-C2-Profiles. Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use.

NetRipper. NetRipper - Smart traffic sniffing for penetration testers

PowerShellArsenal. A PowerShell Module Dedicated to Reverse Engineering

red_team_tool_countermeasures. YARA

SharpMove. .NET Project for performing Authenticated Remote Execution

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

WINspect. Powershell-based Windows Security Auditing Toolbox

sparta. Network Infrastructure Penetration Testing Tool

cortana-scripts. A collection of Cortana scripts that you may use with Armitage and Cobalt Strike.

Powershellery. This repo contains Powershell scripts used for general hackery.

Invoke-Obfuscation. PowerShell Obfuscator

2018. PowerShell Conference Europe 2018 Slides and Demo Scripts

GhostLoader. GhostLoader - AppDomainManager - Injection - 攻壳机动队

InlineExecute-Assembly. InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

PowerUpSQL. PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

netview. Netview enumerates systems using WinAPI calls

Ps-Tools. Ps-Tools, an advanced process monitoring toolkit for offensive operations

PEzor. Open-Source PE Packer

Invoke-AltDSBackdoor. PowerShell

SharpSphere. .NET Project for Attacking vCenter

Misc-PowerShell-Stuff. random powershell goodness

2016. PowerShell Conference EU 2016 Slides and Demo Scripts

IndicatorOfCanary. Canary Detection

cypher_validator. Simple Python validator for Cypher query syntax.

ATPMiniDump. Evading WinDefender ATP credential-theft

RdpThief. Extracting Clear Text Passwords from mstsc.exe using API Hooking.

Recon-AD. Recon-AD, an AD recon tool based on ADSI and reflective DLL’s

WMIReg. PoC to interact with local/remote registry hives through WMI

Dumpert. LSASS memory dumper using direct system calls and API unhooking.

Zipper. Zipper, a CobaltStrike file and folder compression utility.

Inveigh. Inveigh is a Windows PowerShell LLMNR/NBNS spoofer with challenge/response capture over HTTP/SMB

NBDServer. Network Block Device Server for windows with a DFIR/forensic focus.

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

PSReflect. Easily define in-memory enums, structs, and Win32 functions in PowerShell

GetInjectedThreads. C# Implementation of Jared Atkinson's Get-InjectedThread.ps1

BOF.NET. A .NET Runtime for Cobalt Strike's Beacon Object Files

SharpClipboard. C# Clipboard Monitor

slack.

counterfit. a CLI that provides a generic automation layer for assessing the security of ML models