diff --git a/Offensive.md b/Offensive.md index 5549c51..6b7be73 100644 --- a/Offensive.md +++ b/Offensive.md @@ -1927,6 +1927,10 @@ Some tools can be categorized in more than one category. But because the current tothi/rbcd-attack Kerberos Resource-Based Constrained Delegation Attack from Outside using Impacket + + theepicpowner/dcom_av_exec + DCOM_AV_EXEC allows for "diskless" lateral movement to a target on the same network via DCOM. The AV_Bypass_Framework_V3 creates a .NET shellcode runner (output as DLL) which can be used with the DCOM_AV_EXEC tool to bypass antivirus solutions like Microsoft Defender as all shellcode is AES encrypted and executed in memory. + ## Collection