skelsec/aardwolf skelsec/aardwolf

  • Stars
    star
    142
  • Rank 258,495 (Top 6 %)
  • Language
    Python
  • License
    MIT License
  • Created over 2 years ago
  • Updated 4 months ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
skelsec/aardwolf
github

skelsec

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Asynchronous RDP client for Python (headless)

Supported Python versions Twitter

🚩 This is the public repository of aardwolf, for latest version and updates please consider supporting us through https://porchetta.industries/

AARDWOLF - Asynchronous RDP/VNC client in Python (headless)

This project is aimed to play around the RDP and VNC protocols.
Project contains no GUI, for a GUI client please check out aardwolfgui

🚩 Sponsors

If you want to sponsors this project and have the latest updates on this project, latest issues fixed, latest features, please support us on https://porchetta.industries/

Official Discord Channel

Come hang out on Discord!

Porchetta Industries

Important

This is a headless client, for GUI functionality use the aardwolfgui package.

Features

  • Supports credssp auth via NTLM/Kerberos.
  • Built-in proxy client allows SOCKS/HTTP proxy tunneling without 3rd part software
  • PtH via CredSSP+Restricted admin mode
  • Scriptable Keyboard, Mouse input and Clipboard input/output
  • Can run in headless mode, no GUI required (read: no need for Qt)
  • Support for Duckyscript files to emulate keystrokes

Example scripts

  • ardpscan Multi-purpose scanner for RDP and VNC protocols. (screenshot/capabilities/login scanner)

URL format

As usual the scripts take the target/scredentials in URL format. Below some examples

  • rdp+kerberos-password://TEST\Administrator:[email protected]/?dc=10.10.10.2&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080
    CredSSP (aka HYBRID) auth using Kerberos auth + password via socks5 to win2016ad.test.corp, the domain controller (kerberos service) is at 10.10.10.2. The socks proxy is on 127.0.0.1:1080
  • rdp+ntlm-password://TEST\Administrator:[email protected]
    CredSSP (aka HYBRID) auth using NTLM auth + password connecting to RDP server 10.10.10.103
  • rdp+ntlm-password://TEST\Administrator:<NThash>@10.10.10.103
    CredSSP (aka HYBRID) auth using Pass-the-Hash (NTLM) auth connecting to RDP server 10.10.10.103
  • rdp+plain://Administrator:[email protected]
    Plain authentication (No SSL, encryption is RC4) using password connecting to RDP server 10.10.10.103
  • vnc+plain://[email protected]
    VNC client with VNC authentication using password connecting to RDP server 10.10.10.103
  • vnc+plain://[email protected]
    VNC client with VNC authentication using password connecting to RDP server 10.10.10.103
  • vnc+plain://:admin:[email protected]
    VNC client with VNC authentication using password admin:aa connecting to RDP server 10.10.10.103. Note that if the password contains : char you will have to prepend the password with :

Kudos

  • Sylvain Peyrefitte (@citronneur) rdpy. The decompression code and the QT image magic was really valuable.
  • Marc-AndrΓ© Moreau (@awakecoding) for providing suggestions on fixes

More Repositories

1

pypykatz

Mimikatz implementation in pure Python
Python
2,799
star
2

jackdaw

gather gather gather
Python
556
star
3

kerberoast

Kerberoast attack -pure python-
Python
413
star
4

msldap

LDAP library for auditing MS AD
Python
357
star
5

evilrdp

Python
281
star
6

minidump

Python library to parse and read Microsoft minidump file format
Python
271
star
7

minikerberos

Kerberos manipulation library in pure Python
Python
244
star
8

aiosmb

Fully asynchronous SMB library written in pure python
Python
193
star
9

pypykatz_server

Pypykatz server
Python
124
star
10

Responder3

Responder for Python3
Python
95
star
11

pypykatz_agent_dn

Pypykatz agent implemented in .NET
C#
85
star
12

CVE-2017-12542

Test and exploit for CVE-2017-12542
Python
84
star
13

pysnaffler

pysnaffler
Python
82
star
14

PyKerberoast

Implementing Kerberoast attack fully in python
Python
72
star
15

adiskreader

Async Python library to parse local and remote disk images.
Python
70
star
16

asysocks

Socks5 / Socks4 client and server library
Python
66
star
17

aardwolfgui

Asynchronous RDP/VNC client for Python (GUI)
Python
62
star
18

octopwnweb

OctoPwn in your browser
JavaScript
58
star
19

BitErrant

BitErrant
Objective-C
58
star
20

pypykatz_wasm

pypykats in your browser
Python
53
star
21

socksohttp

Socks5 server over Websockets
Python
40
star
22

windows_ad_dos_poc

PoC code for crashing windows active directory
Python
34
star
23

aroadtools

fully async implementation of Dirkjan's ROADTools
Python
31
star
24

pypykatz-volatility3

pypykatz plugin for volatility3 framework
Python
30
star
25

wsnet

wsnet
Python
24
star
26

anfs

Asynchronous NFSv3 client in pure Python
Python
22
star
27

aesedb

async parser for JET
Python
21
star
28

pydesfire

Desfire card library for Python
Python
18
star
29

aiowinreg

Registry hive parsing the async way
Python
18
star
30

winsspi

Windows SSPI wrapper in prue python
Python
15
star
31

winacl

Platform independent library for interfacing windows security descriptors
Python
15
star
32

unicrypto

Unified interface for some crypto algos
Python
12
star
33

wsnet-dotnet

C#
12
star
34

LocalNTLMTest

Tool to acquire netNTLM hashes on a local machine wihtout network traffic
Python
11
star
35

pysecur3

Python communication library for BiSecur devices
Python
11
star
36

HuaweiSMSender

Python script to send SMS using Huawei new[er] USB dongles via the HTTP interface
Python
11
star
37

asyauth

Python
10
star
38

nimwsnetproxy

websockets-tcp proxy in nim
Nim
10
star
39

foscam_stupid_poc

PoC auth bypass for some IP cameras. Vendor unknown
Python
9
star
40

socks5line

Helping tunneling for proxy-unaware scripts
Python
9
star
41

awinrm

Python
8
star
42

amurex

asynchronous SSH client in Python
Python
8
star
43

multiplexor

this will be interesting....
Python
8
star
44

aiosecretsdump

Secretsdump for aiosmb
Python
8
star
45

sprayit

Password spraying toolkit
Python
7
star
46

pyodide-wsnetwork

Websocket to TCP proxy for pyodide
Python
7
star
47

COMP128

initial commit
Python
6
star
48

duckysvc

webscokets service to use usb hid keyboard devices with rubberducky scripts
Python
5
star
49

sslyzedb

Database and reporting backed for sslyze
Python
4
star
50

zipserver

zipserver
C#
4
star
51

mysql_client_libload

PoC for loading arbitrary shared libraries to mysql-client.
Python
3
star
52

jdauto

Auto collection service for JackDaw and Mulitplexor
Python
3
star
53

aiogps

Library to interface with gpsd using asyncio
Python
2
star
54

winrecon

winrecon
Python
2
star
55

responder3-log-discord

Discord logging extension for Responder3
Python
2
star
56

unidns

basic async DNS library
Python
2
star
57

responder3-log-splunk

Splunk HTTP Event Colletor logging extension for Responder3
Python
2
star
58

CubieTruckManager

Framework to manage/control cubietruck board
Python
1
star
59

jdiotclient

C#
1
star
60

secop

2nd OPinion - DB driven scanning
Python
1
star
61

GPSTrackerServer

Server side code for the GPSTracker framework
Python
1
star
62

responder3-log-logstash

Logstash TCP logging extension for Responder3
Python
1
star
63

bucketindex

index.html that allows browsing the gcp bucket
HTML
1
star
64

responder3-log-remote-ws

Responder3 plugin for remote logging over websockets
Python
1
star
65

GPSTracker

Client - Server based tracker with DB and fireworks and everything
Python
1
star
66

guidedog-nmap

Nmap XML script parser for
Python
1
star
67

buildall

Python
1
star
68

GPSTrackerClientWS

Client part of the GPSTracker suite running on websockets
Python
1
star