Will Schroeder

Cheat sheets for various projects.

Python script that takes new output from Get-DomainTrustMapping .csvs and outputs graphml. Based on DomainTrustExplorer.

The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification

This version of PowerUp is now unsupported. See https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp for the most current version.

Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.

Misc. PowerShell scripts

This is a Python port of lnk-parse-1.0, a tool to parse Windows .lnk files.

This is a pack of Cortana scripts commonly used on our pentests.

This is a simple parser for/decrypter for Impacket's esentutl.py utility. It assists with decrypting hashes and hash histories from ntds.dit databases.

Offensive Data Storage

Arya is a simple obfuscator for .NET binaries.

Defensive-oriented Active Directory enumeration

Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use.

NetRipper - Smart traffic sniffing for penetration testers

A PowerShell Module Dedicated to Reverse Engineering

No description.

.NET Project for performing Authenticated Remote Execution

PowerSploit - A PowerShell Post-Exploitation Framework

Network Infrastructure Penetration Testing Tool

Powershell-based Windows Security Auditing Toolbox

A collection of Cortana scripts that you may use with Armitage and Cobalt Strike.

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

GhostLoader - AppDomainManager - Injection - 攻壳机动队

PowerShell Obfuscator

PowerShell Conference Europe 2018 Slides and Demo Scripts

This repo contains Powershell scripts used for general hackery.

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

Open-Source PE Packer

Ps-Tools, an advanced process monitoring toolkit for offensive operations

No description.

Netview enumerates systems using WinAPI calls

Canary Detection

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

Evading WinDefender ATP credential-theft

Simple Python validator for Cypher query syntax.

.NET Project for Attacking vCenter

PowerShell Conference EU 2016 Slides and Demo Scripts

random powershell goodness

Recon-AD, an AD recon tool based on ADSI and reflective DLL’s

Zipper, a CobaltStrike file and folder compression utility.

LSASS memory dumper using direct system calls and API unhooking.

Network Block Device Server for windows with a DFIR/forensic focus.

PoC to interact with local/remote registry hives through WMI

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

Inveigh is a Windows PowerShell LLMNR/NBNS spoofer with challenge/response capture over HTTP/SMB

Go collector for adding Ansible WorX and Ansible Tower attack paths to BloodHound with OpenGraph

Python script for analyis of the "Trust.csv" file generated by Veil PowerView. Provides graph based analysis and output.

Easily define in-memory enums, structs, and Win32 functions in PowerShell

C# Implementation of Jared Atkinson's Get-InjectedThread.ps1

No description.

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

Six Degrees of Domain Admin

A Bind Shell Using the Fax Service and a DLL Hijack

a CLI that provides a generic automation layer for assessing the security of ML models

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

No description.

A .NET Runtime for Cobalt Strike's Beacon Object Files

C# Clipboard Monitor

This repo is the home of the official Visual Studio, Visual Studio for Mac, Visual Studio Subscriptions, and Scripting Technologies documentation for Microsoft.

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 459 detection rules with live credential validation.

SpecterOps Historical Records

Tool to transplant a valid code signature from one Portable Executable (PE) binary to another.

A tool to exploit .NET Remoting Services

Copy of https://bitbucket.org/janvrany/jenkins-27413-workaround-library

No description.

pydecipher: unfreeze and deobfuscate your frozen python code

No description.