10.11. Operating System Persistence

10.11.1. Windows

10.11.1.1. Privilege Escalation

  • mimikatz

  • RdpThief Extracting Clear Text Passwords from mstsc.exe using API Hooking

  • quarkspwdump Dump various types of Windows credentials without injecting in any process

  • SharpDump C# port of PowerSploit’s Out-Minidump.ps1 functionality

10.11.1.2. Privilege Escalation

  • WindowsExploits

  • GTFOBins Curated list of Unix binaries that can be exploited to bypass system security restrictions

  • JAWS Just Another Windows (Enum) Script

10.11.1.3. UAC Bypass

10.11.1.4. Avoid killing

  • SigThief Stealing Signatures and Making One Invalid Signature at a Time

10.11.1.5. C2

  • SharpSploit .NET post-exploitation library written in C#

  • SharpBeacon rewrote CobaltStrike stager and Beacon with .net, including a series of functions such as normal online, file management, process management, token management, injection combined with SysCall, native port forwarding, and ETW off

  • Koadic is a Windows post-exploitation rootkit

10.11.1.6. Hide

  • ProcessHider Post-exploitation tool for hiding processes from monitoring applications

  • Invoke Phant0m Windows Event Log Killer

  • EventCleaner A tool mainly to erase specified records from Windows event logs, with additional functionalities

10.11.1.7. DLL injection

  • sRDI Shellcode Reflective DLL Injection

10.11.1.8. rootkit

  • r77-rootkit Ring 3 rootkit with single file installer and fileless persistence that hides processes, files, network connections, etc

10.11.1.9. Forgery

  • parent PID spoofing Scripts for performing and detecting parent PID spoofing

  • GetSystem This is a C# implementation of making a process/executable run as NT AUTHORITY/SYSTEM. This is achieved through parent ID spoofing of almost any SYSTEM process.

10.11.1.10. MiTM

  • Seth Perform a MitM attack and extract clear text credentials from RDP connections

  • pyrdp RDP man-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

10.11.1.11. Synthesis Tools

  • Nishang Offensive PowerShell for red team, penetration testing and offensive security

10.11.2. Linux

10.11.2.1. Privilege Escalation

10.11.2.2. rootkit

  • rootkit

  • Diamorphine LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)

10.11.2.3. Backdoors

  • prism is an user space stealth reverse shell backdoor

  • icmpsh Simple reverse ICMP shell

10.11.3. Synthesis

10.11.3.1. Credential acquisition

  • sshLooterC program to steal passwords from ssh

  • keychaindump A proof-of-concept tool for reading OS X keychain passwords

  • LaZagne Credentials recovery project

  • SecretScanner Find secrets and passwords in container images and file systems

10.11.3.2. Privilege Escalation

  • BeRoot Privilege Escalation Project - Windows / Linux / Mac

10.11.3.3. RAT

10.11.3.4. C2

  • Empire

  • pupy

  • Covenant is a collaborative .NET C2 framework for red teamers

  • Cooolis-ms contains code execution tools for Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection

10.11.3.5. DNS Shell

  • DNS Shell DNS-Shell is an interactive Shell over DNS channel

  • Reverse DNS Shell A python reverse shell that uses DNS as the c2 channel

10.11.3.6. Cobalt Strike

10.11.3.7. Log Clearing

  • Log killer Clear all logs in [linux/windows] servers

10.11.3.8. Botnet

  • byob Build Your Own Botnet

10.11.3.9. Anti-kill tool

  • AV Evasion Tool A tool for generating anti-kill executors

  • DKMC Dont kill my cat - Malicious payload evasion tool