CCob/SweetPotato

Stars
1,598
Rank 29,281 (Top 0.6 %)
Language
C#
Created over 4 years ago
Updated 3 months ago

CCob/SweetPotato

CCob

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

SweetPotato

A collection of various native Windows privilege escalation techniques from service accounts to SYSTEM

SweetPotato by @_EthicalChaos_
  Orignal RottenPotato code and exploit by @foxglovesec
  Weaponized JuciyPotato by @decoder_it and @Guitro along with BITS WinRM discovery
  PrintSpoofer discovery and original exploit by @itm4n
  EfsRpc built on EfsPotato by @zcgonvh and PetitPotam by @topotam
  -c, --clsid=VALUE          CLSID (default BITS:
                               4991D34B-80A1-4291-83B6-3328366B9097)
  -m, --method=VALUE         Auto,User,Thread (default Auto)
  -p, --prog=VALUE           Program to launch (default cmd.exe)
  -a, --args=VALUE           Arguments for program (default null)
  -e, --exploit=VALUE        Exploit mode
                               [DCOM|WinRM|EfsRpc|PrintSpoofer(default)]
  -l, --listenPort=VALUE     COM server listen port (default 6666)
  -h, --help                 Display this help

SharpBlock

A method of bypassing EDR's active projection DLL's by preventing entry point exection

BeaconEye

Hunts out CobaltStrike beacons and logs operator command output

ThreadlessInject

Threadless Process Injection using remote function hooking.

BOF.NET

A .NET Runtime for Cobalt Strike's Beacon Object Files

lsarelayx

NTLM relaying for Windows made easy

Volumiser

okta-terrify

Okta Verify and Okta FastPass Abuse Tool

MirrorDump

Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

MinHook.NET

A C# port of the MinHook API hooking library

goreflect

Reflective DLL loading of your favorite Golang program

SylantStrike

Simple EDR implementation to demonstrate bypass

gssapi-abuse

A tool for enumerating potential hosts that are open to GSSAPI abuse within Active Directory networks

DGPOEdit

Disconnected GPO Editor - A Group Policy Manager launcher to allow editing of domain GPOs from non-domain joined machines

Shwmae

PIVert

dnMerge

A lightweight .NET assembly dependency merger that uses dnLib and 7zip's LZMA SDK for compressing dependant assemblies.

PinSwipe

Smart Card PIN swiping DLL

gookies

A Chrome cookie dumping utility

PwnyForm

ProvisionAppx

bittrex4j

Java library for accessing the Bittrex Web API's and Web Sockets

PoC

Exploit PoC for CVE's and non CVE's alike

Jboss-Wilfly-Hashes-to-Hashcat

Converts JBoss/Wildfly management users properties file to hashcat format compatible with mode 20

VulnHub

VulnHub Walkthroughs

MediaPortal-AsteriskCid