Exploit the credentials present in files and memory
Reflective DLL injection is a library injection technique that is primarily used to perform the loading of a library from memory to host processes. The library should therefore be able to load itself by implementing a minimal PE file loader, managed with minimal interaction between the host system and processes.
Monitor station reverse injection
HTTP/S Beaconing Implant
A swiss army knife for pentesting Windows/Active Directory environments
Nishang is a PowerShell-based penetration testing tool. Integration of frameworks, scripts and various payloads. These scripts are written by Nishang’s author in the real penetration testing process, with actual combat value. Including the download and execution, keyboard records, dns, delay commands and other scripts.
Executes PowerShell from an unmanaged process. With a few modifications, these same techniques can be used when injecting into different processes (i.e. you can cause any process to execute PowerShell if you want).
Unicorn is a simple tool for PowerShell downgrade attacks and direct injection of shellcode into memory.
PowerShell: http://ift.tt/2qqzwu3 tools in this directory are part of PowerSploit and are being maintained there. They are preserved here for legacy, but any bug fixes should be checked in to PowerSploit.
PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Powershell scripts for SQL Server database administration
PowerTools Tools: https//http://ift.tt/2poQb2z
PowerTools is a collection of PowerShell projects with a focus on offensive operations.
PowerShell module for reverse engineering, can be disassembled hosting and unmanaged code, for. NET malware analysis, analysis of memory, parsing file formats and memory structure, access to internal system information.
PowerShell API Manual: http://www.pinvoke.net/
PInvoke.net is primarily a wiki that allows developers to find, edit, and add PInvoke’s * signatures, user-defined types, and any other information associated with calling managed code for Win32 and other unmanaged APIs.
The AD-Recon-PowerShell: http://ift.tt/1BYtAu1
A useful PowerShell script
The PowerCat: http://ift.tt/1HyNVKV
PowerShell TCP / IP Swiss Army Knife for Netcat & Ncat.
A PowerShell script for creating Windows honeyport
PowerSploit is the set of PowerShell modules in Microsoft that can help Infiltrators evaluate at all stages.
PowerShell Module with Security cmdlets for security work
Interactive remote PowerShell Payload