10.11. Operating System Persistence¶
10.11.1. Windows¶
10.11.1.1. Privilege Escalation¶
RdpThief Extracting Clear Text Passwords from mstsc.exe using API Hooking
quarkspwdump Dump various types of Windows credentials without injecting in any process
SharpDump C# port of PowerSploit’s Out-Minidump.ps1 functionality
10.11.1.2. Privilege Escalation¶
10.11.1.3. UAC Bypass¶
10.11.1.4. Avoid killing¶
SigThief Stealing Signatures and Making One Invalid Signature at a Time
10.11.1.5. C2¶
SharpSploit .NET post-exploitation library written in C#
SharpBeacon rewrote CobaltStrike stager and Beacon with .net, including a series of functions such as normal online, file management, process management, token management, injection combined with SysCall, native port forwarding, and ETW off
Koadic is a Windows post-exploitation rootkit
10.11.1.6. Hide¶
ProcessHider Post-exploitation tool for hiding processes from monitoring applications
Invoke Phant0m Windows Event Log Killer
EventCleaner A tool mainly to erase specified records from Windows event logs, with additional functionalities
10.11.1.7. DLL injection¶
sRDI Shellcode Reflective DLL Injection
10.11.1.8. rootkit¶
r77-rootkit Ring 3 rootkit with single file installer and fileless persistence that hides processes, files, network connections, etc
10.11.1.9. Forgery¶
parent PID spoofing Scripts for performing and detecting parent PID spoofing
GetSystem This is a C# implementation of making a process/executable run as NT AUTHORITY/SYSTEM. This is achieved through parent ID spoofing of almost any SYSTEM process.
10.11.1.10. MiTM¶
10.11.1.11. Synthesis Tools¶
Nishang Offensive PowerShell for red team, penetration testing and offensive security
10.11.2. Linux¶
10.11.2.1. Privilege Escalation¶
LinEnum Scripted Local Linux Enumeration & Privilege Escalation Checks
10.11.2.2. rootkit¶
Diamorphine LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)
10.11.2.3. Backdoors¶
10.11.3. Synthesis¶
10.11.3.1. Credential acquisition¶
sshLooterC program to steal passwords from ssh
keychaindump A proof-of-concept tool for reading OS X keychain passwords
LaZagne Credentials recovery project
SecretScanner Find secrets and passwords in container images and file systems
10.11.3.2. Privilege Escalation¶
BeRoot Privilege Escalation Project - Windows / Linux / Mac
10.11.3.3. RAT¶
10.11.3.4. C2¶
Covenant is a collaborative .NET C2 framework for red teamers
Cooolis-ms contains code execution tools for Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection
10.11.3.5. DNS Shell¶
DNS Shell DNS-Shell is an interactive Shell over DNS channel
Reverse DNS Shell A python reverse shell that uses DNS as the c2 channel
10.11.3.6. Cobalt Strike¶
CrossC2 generate CobaltStrike’s cross-platform payload
10.11.3.7. Log Clearing¶
Log killer Clear all logs in [linux/windows] servers
10.11.3.8. Botnet¶
byob Build Your Own Botnet
10.11.3.9. Anti-kill tool¶
AV Evasion Tool A tool for generating anti-kill executors
DKMC Dont kill my cat - Malicious payload evasion tool