sparkns Goto Github PK

pe_to_shellcode

Converts PE into a shellcode

pillager

浏览器读取

pltools

整理一些内网常用渗透小工具

poc-exp

收集或编写各种漏洞PoC、ExP

poclist

Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongyou-GRP-U8-XXE/Oracle-WebLogic-CVE-2020-14883/Oracle-WebLogic-CVE-2020-14882/Apache-Solr-GetAnyFile/F5-BIG-IP-CVE-2021-22986/Sonicwall-SSL-VPN-RCE/GitLab-Graphql-CNVD-2021-14193/D-Link-DCS-CVE-2020-25078/WLAN-AP-WEA453e-RCE/360TianQing-Unauthorized/360TianQing-SQLinjection/FanWeiOA-V8-SQLinjection/QiZhiBaoLeiJi-AnyUserLogin/QiAnXin-WangKangFirewall-RCE/金山-V8-终端安全系统/NCCloud-SQLinjection/ShowDoc-RCE

pocsploit

a lightweight, flexible and novel open source poc verification framework

printnightmare

priv2admin

Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.

r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

rdpwrap

RDP Wrapper Library

redismodules-executecommand-for-windows

可在Windows下执行系统命令的Redis模块，可用于Redis主从复制攻击。

rediswritefile

通过 Redis 主从写出无损文件

remotepotato0

Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin.

responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

reverse_dirty

更改的脏牛提权代码，可以往任意文件写入任意内容

roguepotato

Another Windows Local Privilege Escalation from Service Account to System

safetykatz

SafetyKatz是@gentilkiwi的Mimikatz项目和@subTee的.NET PE Loader 的略微修改版本的组合

sam-the-admin

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

schtask_0x727

创建隐藏计划任务，权限维持，Bypass AV

session_enum

通过NetSessionEnum获取域内机器对应用户

shadowbroker

The Shadow Brokers "Lost In Translation" leak

sharpdecryptpwd

对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。

sharpdpapi

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

sharpeventlog

c# 读取登录过本机的登录失败或登录成功（4624，4625）的所有计算机信息，在内网渗透中快速定位运维管理人员。

sharplogger

Keylogger written in C#

sharpnetcheck

在内网渗透过程中，对可以出网的机器是十分渴望的。在收集大量弱口令的情况下，一个一个去测试能不能出网太麻烦了。所以就有了这个工具，可配合如wmiexec、psexec等横向工具进行批量检测，该工具可以在dnslog中回显内网ip地址和计算机名，可实现内网中的快速定位可出网机器。

sharpsqltools

SharpSQLTools 和@Rcoil一起写的小工具，可上传下载文件，xp_cmdshell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。

sharptoolsaggressor

内网渗透中常用的c#程序整合成cs脚本，直接内存加载。持续更新~

sharpxdecrypt

Xshell全版本密码恢复工具

shellcodeloader

shellcodeloader