• Stars
    star
    255
  • Rank 159,729 (Top 4 %)
  • Language
    Python
  • License
    Other
  • Created over 5 years ago
  • Updated over 3 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Red team & penetration testing tools to exploit the capabilities of Intel AMT

DeathMetal

"We are here to make coffee APT metal. We will make everything metal. Blacker than the blackest black times infinity."

DeathMetal is a suite of tools that interact with Intel AMT. Its kind of a foray into a world filled with intrigue and reversing puzzles with useful results.

Since this is super serious, tools are named after Metalocalypse characters.

Tools are prefixed with "dm_" to help with tab-completion and recognition.

  • dm_pickles - Duckyscript interpreter that communicates over AMT KVM (vnc) and injects keystrokes.
  • dm_toki - IDE-R implementation - lets you attach floopy and CD images remotely to the target computer.
  • dm_nathan - Is a cli that allows for configuring AMT via authenticated channel
  • dm_rockso - Presence and version scanner, can help you find AMT capable systems regardless of provisioning status. (works even if explicitly not-enabled)

Code that is common to more than one tool lives in a library called 'Charles', at the moment it can pretty much just help set up Redirection service stuff.

Getting Started

You may want to run in a virtual env and install any dependencies that come up - the code is in python3.

Prerequisites

Python3 and pip

Installing

PIP

First, I would make a virtual python3 environment and activate it.
pip install git+https://github.com/Coalfire-Research/DeathMetal.git

Built With

  • Python3 default libs
  • hexdump for debugging
  • requests for http.

Contributing

Submit a pull request, or talk to me or something.

Authors

See also the list of contributors who participated in this project.

License

This project is licensed under a modified MIT License - see the LICENSE file for details

Acknowledgments

  • Jimmy Twotimes for pointing me at the scanning capabilities - this became rockso, thanks man!
  • Clutchisback for the beef hooks and help with the blog post - greatly appreciated.
  • Soen knows what he did.
  • Coalfire for the opportunity

More Repositories

1

Red-Baron

Automate creating resilient, disposable, secure and agile infrastructure for Red Teams.
HCL
856
star
2

npk

A mostly-serverless distributed hash cracking platform
JavaScript
791
star
3

java-deserialization-exploits

A collection of curated Java Deserialization Exploits
Python
586
star
4

Slackor

A Golang implant that uses Slack as a command and control server
Python
451
star
5

iOS-11.1.2-15B202-Jailbreak

iOS 11.1.2 (15B202) Jailbreak
C
430
star
6

sqlinator

Automatically forward HTTP GET & POST requests to SQLMap's API to test for SQLi and XSS
Python
81
star
7

Vampire

Vampire is an aggressor script which integrates with BloodHound to mark nodes as owned.
Python
77
star
8

Doozer

Password cracking utility
Python
51
star
9

ERC.Xdbg

An Xdbg Plugin of the ERC Library.
C#
26
star
10

pymetasploit3

Python3 Metasploit automation library
PowerShell
22
star
11

HashBot

IRC bot for cracking hashes
Python
19
star
12

Git-Scrapers

Collect OSINT from git repositories
Ruby
18
star
13

autorelayx

Automatically perform advanced NTLM hash relay attacks
Python
15
star
14

LambProxy

HTTP Proxy using Amazon Lambda for source IP cycling
Python
15
star
15

IP-sampler

Ping sweep a list of subnets then save a random % sample of the hosts that are up
Python
10
star
16

ERC.Net

A collection of tools for debugging Windows application crashes.
C#
9
star
17

WinAPRS-Exploits

A collection of exploits, shellcode, and tools related to CVE-2022-24702
Python
8
star
18

AnomalousCookie

Find anomalies using AnomalousCookie!
Python
8
star
19

Nmap-Extensions

Extensions to Nmap written for the NSE
Lua
6
star
20

AppSec-2014-Presentation

Presentation for Application Hacking 101 at AppSec 2014
3
star
21

paas-cloud-goat

PaaS Cloud Goat is a simulated vulnerable Salesforce application providing hands-on experience with penetration testing of custom Salesforce applications.
Apex
2
star
22

cazt

Cloud AuthZ Trainer - A a simulator of cloud-provider responsible REST APIs. It includes a lab manual for getting hands-on practice with how to attack authorization vulnerabilities in a cloud API.
Python
2
star
23

webvulns-db

Webvulns-db scripts
Python
1
star
24

freezeout

Notes on acquiring a domain user list via kerberos
Python
1
star