# Offensive Bookmark

This page will contain my bookmark for offensive tools, briefly categorized based on [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/). Some links and sections on [README.md](README.md) will be relocated to this page if it's related to offensive tactics and techniques. Some tools can be categorized in more than one category. But because the current bookmark model doesn't support 1-to-many mapping, I will decide a tool's category based on its ultimate goal. - [Reconnaissance/Discovery](#reconnaissancediscovery) - [Execution](#execution) - [Manipulating Binary's Internal](#manipulating-binarys-internal) - [Payload Generation](#payload-generation) - [Persistence](#persistence) - [Privilege Escalation](#privilege-escalation) - [Defense Evasion](#defense-evasion) - [Credential Access](#credential-access) - [Lateral Movement](#lateral-movement) - [Command & Control](#command--control) - [Exfiltration](#exfiltration) ## Reconnaissance/Discovery
Link Description
danielbohannon/Invoke-CradleCrafter PowerShell Remote Download Cradle Generator & Obfuscator
dev-2null/ADCollector A lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending.
dirkjanm/ROADtools The Azure AD exploration framework.
djhohnstein/SharpShares Enumerate all network shares in the current domain. Also, can resolve names to IP addresses.
GhostPack/Seatbelt Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
jaredhaight/scout A .NET assembly for performing recon against hosts on a network
mdsecactivebreach/sitrep SitRep is intended to provide a lightweight, extensible host triage alternative.
NetSPI/goddi goddi (go dump domain info) dumps Active Directory domain information
outflanknl/Recon-AD Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
rasta-mouse/Watson Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilitiesEnumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
stufus/reconerator C# Targeted Attack Reconnissance Tools
sud0woodo/DCOMrade Powershell script for enumerating vulnerable DCOM Applications
tevora-threat/SharpView C# implementation of harmj0y's PowerView
TonyPhipps/Meerkat A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
## Execution
Link Description
api0cradle/LOLBAS Living Off The Land Binaries and Scripts (and now also Libraries)
bohops/GhostBuild GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects
cdong1012/Crab-Runner Shellcode runner in Rust
checkymander/Zolom C# Executable with embedded Python that can be used reflectively to run python code on systems without Python installed
cobbr/SharpSploit SharpSploit is a .NET post-exploitation library written in C#
Cn33liz/p0wnedShell p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET)
D00MFist/Go4aRun Shellcode runner in GO that incorporates shellcode encryption, remote process injection, block dlls, and spoofed parent process
dtrizna/easy-hollow Automated build for process hollowing shellcode loader. Build on top of TikiTorch and donut projects.
Flangvik/SharpCollection Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.
FuzzySecurity/PowerShell-Suite There are great tools and resources online to accomplish most any task in PowerShell, sometimes however, there is a need to script together a util for a specific purpose or to bridge an ontological gap. This is a collection of PowerShell utilities I put together either for fun or because I had a narrow application in mind.
GhostPack/SharpWMI SharpWMI is a C# implementation of various WMI functionality.
hausec/MaliciousClickOnceMSBuild Basic C# Project that will take an MSBuild payload and run it with MSBuild via ClickOnce.
jhalon/SharpCall Simple PoC demonstrating syscall execution in C#
mgeeky/Stracciatella OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup
Mr-Un1k0d3r/RedTeamCSharpScripts C# Script used for Red Team. These binaries can be used by Cobalt Strike execute-assembly or as standalone executable.
nccgroup/GTFOBLookup Offline command line lookup utility for GTFOBins
NYAN-x-CAT/Csharp-Loader Download a .NET payload and run it on memory
rasta-mouse/MiscTools Miscellaneous Tools
ropnop/go-sharp-loader.go Example Go program with multiple .NET Binaries embedded
sh4hin/GoPurple Yet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions
### Manipulating Binary's Internal
Link Description
Cybellum/DoubleAgent DoubleAgent is a new Zero-Day technique for injecting code and maintaining persistence on a machine (i.e. auto-run).
Flangvik/SharpDllProxy Retrieves exported functions from a legitimate DLL and generates a proxy DLL source code/template for DLL proxy loading or sideloading
/forrest-orr/phantom-dll-hollower-poc Phantom DLL hollowing PoC
GoodstudyChina/APC-injection-x86-x64 injdrv is a proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC.
jonatan1024/clrinject Injects C# EXE or DLL Assembly into every CLR runtime and AppDomain of another process.
jthuraisamy/SysWhispers SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls.
mobdk/Sigma Execute shellcode with ZwCreateSection, ZwMapViewOfSection, ZwOpenProcess, ZwMapViewOfSection and ZwCreateThreadEx
monoxgas/sRDI Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
stephenfewer/ReflectiveDLLInjection Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process
slyd0g/UrbanBishopLocal A port of FuzzySecurity's UrbanBishop project for inline shellcode execution. The execution vector uses a delegate vs an APC on a suspended threat at ntdll!RtlExitUserThread in UrbanBishop
r3nhat/XORedReflectiveDLL Reflective DLL Injection with obfuscated (XOR) shellcode
### Payload Generation
Link Description
BC-SECURITY/Empire Empire is a PowerShell and Python post-exploitation agent.
Binject/backdoorfactory A from-scratch rewrite of The Backdoor Factory - a MitM tool for inserting shellcode into all types of binaries on the wire.
BishopFox/sliver Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
cedowens/Mythic-Macro-Generator Python3 script to generate a macro to launch a Mythic payload. Author: Cedric Owens
damienvanrobaeys/PS1-To-EXE-Generator PS1 to EXE Generator: Create an EXE for your PS1 scripts
FortyNorthSecurity/EXCELntDonut Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.
FortyNorthSecurity/hot-manchego Macro-Enabled Excel File Generator (.xlsm) using the EPPlus Library.
gen0cide/gscript framework to rapidly implement custom droppers for all three major operating systems
glinares/InlineShapesPayload VBA InlineShapes Payload Generator
Greenwolf/ntlm_theft A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)
infosecn1nja/MaliciousMacroMSBuild Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass.
l373/GIVINGSTORM Infection vector that bypasses AV, IDS, and IPS. (For now...)
mdsecactivebreach/SharpShooter SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code.
michaelweber/Macrome Excel Macro Document Reader/Writer for Red Teamers & Analysts
Mr-Un1k0d3r/MaliciousDLLGenerator DLL Generator for side loading attack
Plazmaz/LNKUp Generates malicious LNK file payloads for data exfiltration
redcanaryco/chain-reactor Chain Reactor is an open source framework for composing executables that simulate adversary behaviors and techniques on Linux endpoints.
sevagas/macro_pack macro_pack is a tool used to automatize obfuscation and generation of MS Office documents for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify antimalware bypass and automatize the process from vba generation to final Office document generation.
TheWover/donut Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
trustedsec/unicorn Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
## Persistence
Link Description
0xthirteen/SharpStay .NET project for installing Persistence
360-Linton-Lab/Telemetry TELEMETRY is a C# For Windows PERSISTENCE
airzero24/PortMonitorPersist PoC for Port Monitor Persistence
fireeye/SharPersist Windows persistence toolkit written in C#.
panagioto/SyscallHide Create a Run registry key with direct system calls. Inspired by @Cneelis's Dumpert and SharpHide.
slaeryan/MIDNIGHTTRAIN Covert Stage-3 Persistence Framework
## Privilege Escalation
Link Description
0xbadjuju/Tokenvator A tool to elevate privilege with Windows Tokens
411Hall/JAWS JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential privilege escalation vectors on Windows systems. It is written using PowerShell 2.0 so 'should' run on every Windows version since Windows 7.
antonioCoco/RogueWinRM Windows Local Privilege Escalation from Service Account to System
carlospolop/privilege-escalation-awesome-scripts-suite PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
hlldz/dazzleUP A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems.
itm4n/PrivescCheck Privilege Escalation Enumeration Script for Windows
sailay1996/delete2SYSTEM Weaponizing for Arbitrary Files/Directories Delete bugs to Get NT AUTHORITY\SYSTEM
## Defense Evasion
Link Description
89luca89/pakkero Pakkero is a binary packer written in Go made for fun and educational purpose. Its main goal is to take in input a program file (elf binary, script, even appimage) and compress it, protect it from tampering and intrusion.
api0cradle/UltimateAppLockerByPassList The goal of this repository is to document the most common techniques to bypass AppLocker.
Arvanaghi/CheckPlease Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.
bats3c/Ghost-In-The-Logs Evade sysmon and windows event logginEvade sysmon and windows event loggingg
bhumic/PErmutator The goal of this project is to create a permutation engine for PE files. The engine should randomize the executable parts of the file.
bohops/UltimateWDACBypassList A centralized resource for previously documented WDAC bypass techniques
br-sn/CheekyBlinder Enumerating and removing kernel callbacks using signed vulnerable drivers
c0de90e7/GhostWriting GhostWriting Injection Technique.
CCob/SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution.
cwolff411/powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity.
d00rt/ebfuscator Ebfuscator: Abusing system errors for binary obfuscation
d35ha/CallObfuscator Obfuscate specific windows apis with different apis
danielbohannon/Invoke-DOSfuscation Cmd.exe Command Obfuscation Generator & Detection Test Harness
DarthTon/Polychaos PE permutation library
dsnezhkov/zombieant Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.
EgeBalci/Amber amber is a reflective PE packer for bypassing security products and mitigations. It can pack regularly compiled PE files into reflective payloads that can load and execute itself like a shellcode.
ffuf/pencode Complex payload encoder
fireeye/OfficePurge VBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents.
hlldz/Invoke-Phant0m Windows Event Log Killer
huntresslabs/evading-autoruns Slides and reference material from Evading Autoruns presentation at DerbyCon 7 (September 2017)
jthuraisamy/TelemetrySourcerer Enumerate and disable common sources of telemetry used by AV/EDR.
matterpreter/DefenderCheck Identifies the bytes that Microsoft Defender flags on.
mdsecactivebreach/Chameleon Chameleon: A tool for evading Proxy categorisation
mdsecactivebreach/firewalker This repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing code
nccgroup/demiguise HTA encryption tool for RedTeams
NotPrab/.NET-Obfuscator Lists of .NET Obfuscator (Free, Trial, Paid and Open Source )
OmerYa/Invisi-Shell Hide your Powershell script in plain sight. Bypass all Powershell security features
OsandaMalith/PE2HTML Injects HTML/PHP/ASP to the PE
peewpw/Invoke-PSImage Embeds a PowerShell script in the pixels of a PNG file and generates a oneliner to execute
PwnDexter/SharpEDRChecker Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.
secretsquirrel/SigThief Stealing Signatures and Making One Invalid Signature at a Time
slyd0g/SharpCrashEventLog C# port of LogServiceCrash
the-xentropy/xencrypt A PowerShell script anti-virus evasion tool
tokyoneon/chimera Chimera is a (shiny and very hack-ish) PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.
## Credential Access
Link Description
aas-n/spraykatz Credentials gathering tool automating remote procdump and parse of lsass process.
Arvanaghi/SessionGopher SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
b4rtik/SharpKatz Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands
b4rtik/SharpMiniDump Create a minidump of the LSASS process from memory
blacklanternsecurity/TREVORspray A featureful round-robin SOCKS proxy and Python O365 sprayer based on MSOLSpray which uses the Microsoft Graph API
DanMcInerney/icebreaker Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment
eladshamir/Internal-Monologue Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
Flangvik/BetterSafetyKatz Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.
FSecureLABS/physmem2profit Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
G0ldenGunSec/SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py
GhostPack/SafetyKatz SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader
GhostPack/SharpDump SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
GhostPack/Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abusesRubeus is a C# toolset for raw Kerberos interaction and abuses
gitjdm/dumper2020 Yet another LSASS dumper
Hackndo/lsassy Extract credentials from lsass remotely
Kevin-Robertson/Inveigh Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool
nidem/kerberoast Kerberoast is a series of tools for attacking MS Kerberos implementations. Below is a brief overview of what each tool does.
peewpw/Invoke-WCMDump PowerShell Script to Dump Windows Credentials from the Credential Manager
putterpanda/mimikittenz A post-exploitation powershell tool for extracting juicy info from memory.
skelsec/pypykatz Mimikatz implementation in pure Python
SnaffCon/Snaffler Snaffler is a tool for pentesters to help find delicious candy needles (creds mostly, but it's flexible) in a bunch of horrible boring haystacks (a massive Windows/AD environment).
uknowsec/SharpDecryptPwd 对密码已保存在 Windwos 系统上的部分程序进行解析,包括:Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品(Xshell,Xftp)。
Viralmaniar/Remote-Desktop-Caching- This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen.
## Lateral Movement
Link Description
0xthirteen/SharpMove .NET Project for performing Authenticated Remote Execution
0xthirteen/SharpRDP Remote Desktop Protocol .NET Console Application for Authenticated Command Execution
360-Linton-Lab/WMIHACKER A Bypass Anti-virus Software Lateral Movement Command Execution Tool
bohops/WSMan-WinRM A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object
byt3bl33d3r/CrackMapExec A swiss army knife for pentesting networks
cobbr/SharpSploit SharpSploit is a .NET post-exploitation library written in C#
DefensiveOrigins/PlumHound Bloodhound for Blue and Purple Teams
infosecn1nja/SharpDoor SharpDoor is alternative RDPWrap written in C# to allowed multiple RDP (Remote Desktop) sessions by patching termsrv.dll file.
Mr-Un1k0d3r/SCShell Fileless lateral movement tool that relies on ChangeServiceConfigA to run command
rvrsh3ll/SharpCOM SharpCOM is a c# port of Invoke-DCOM
ScorpionesLabs/DVS D(COM) V(ulnerability) S(canner) AKA Devious swiss army knife - Lateral movement using DCOM Objects
tothi/rbcd-attack Kerberos Resource-Based Constrained Delegation Attack from Outside using Impacket
## Command & Control
Link Description
3xpl01tc0d3r/Callidus It is developed using .net core framework in C# language. Allows operators to leverage O365 services for establishing command & control communication channel. It usages Microsoft Graph APIs for communicating with O365 services.
bats3c/shad0w SHAD0W is a modular C2 framework designed to successfully operate on mature environments.
byt3bl33d3r/SILENTTRINITY An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
cobbr/Covenant Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
DeimosC2/DeimosC2 DeimosC2 is a Golang command and control framework for post-exploitation.
fbkcs/ThunderDNS This tool can forward TCP traffic over DNS protocol. Non-compile clients + socks5 support.
mhaskar/Octopus Open source pre-operation C2 server based on python and powershell
nettitude/SharpSocks Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell
Ne0nd0g/merlin Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
p3nt4/Nuages A modular C2 framework
Project Prismatica Project Prismatica is a focused framework for Command and Control that is dedicated to extensibility.
sensepost/goDoH godoh - A DNS-over-HTTPS C2
SpiderLabs/DoHC2 DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).
## Exfiltration
Link Description
evilsocket/sg1 A wanna be swiss army knife for data encryption, exfiltration and covert communication.
hackerschoice/gsocket Global Socket. Moving data from here to there. Securely, Fast and trough NAT/Firewalls
hackerschoice/gs-transfer Secure File Transfer via Global Socket Bounce Network
m57/dnsteal DNS Exfiltration tool for stealthily sending files over DNS requests.
mdsecactivebreach/RegistryStrikesBack RegistryStrikesBack allows a red team operator to export valid .reg files for portions of the Windows Registry via a .NET assembly that should run as a standard user. It can be useful in exfiltrating config files such as to support actions like are described in the "Segmentation Vault" article on the MDSec Blog.
pentestpartners/PTP-RAT Exfiltrate data over screen interfaces. For more information.
sensepost/DET DET (is provided AS IS), is a proof of concept to perform Data Exfiltration using either single or multiple channel(s) at the same time.
SySS-Research/Seth Perform a MitM attack and extract clear text credentials from RDP connections
veggiedefender/browsertunnel
vp777/procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked.