Post-Exploit / Lateral Movement
TODO: Some of these really belong in the scanning section.
General
- Evasion Techniques (CheckPoint)
- Meant for sandbox detection? Not 100% sure, but has some useful info regardless
- Rubeus
- Kerberos fun
- Technically meant for Windows, but has Linux abuse potential as well
- SysWhispers3
- AV/EDR evasion via direct syscalls
- cve
- Gather latest CVEs + any available POCs from GitHub
- Electron Shellcode Loader
- Seguranca Informatica Cheatsheets
C2
- Mythic
- Why? MITRE ATT&CK mappings
- Also see: Nimplant
- Sliver
- Covenant
- Posh
- WSC2
- C2 over WebSocket
- Koadic
- COM C2 framework
- Reference: here
- reinschauer
- Control Windows machines over WebSockets
- SharpSocks
- Tunnellable HTTP/HTTPS socks4a proxy written in C#
- Chisel
- TCP/UDP tunnel over HTTP
- Villain
- C2 framework that can handle multiple TCP socket & HoaxShell-based reverse shells
- TODO: This one seemed particularly interesting when I initially found it, but the tab was open for months, so I can no longer remember why...
Exotic
More exotic/fun ways of doing C2, even if it's less advanced.
- Microsoft-Teams-GIFShell
- Check the article too: "GIFShell" — Covert Attack Chain and C2 Utilizing Microsoft Teams GIFs
Exfiltration
- proxy.py
- Proxy server framework written in Python
- dnscat2
- DNS tunnel for C2
- dnsteal
- Exfiltrate data/files over DNS
- brchd
- Data exfil toolkit
- PowerSploit
- A number of useful functions, e.g. Find-InterestingFile
- PowerExfil
- Not super useful on its own, but a decent enough reference point
- pingfs
- Data exfiltration over ICMP
- LaZagne
- Grab all the creds
- Also a post-exploit module for pupy
- gimmecredz
- Cred extraction from files that typically contain creds
- Teamsniper
- Extract keywords from MS Teams chat logs
- GD-Thief
- Exfiltrate files from Google Drive via Google's API
- GDir-Thief
- Exfiltration Google People Directory
- Conf-Thief
- Exfiltrate data from Confluence
- Slackhound
- Perform recon on Slack
- SlackPirate
- Extract sensitive info from a Slack Wworkspace