• Stars
    star
    1,092
  • Rank 42,434 (Top 0.9 %)
  • Language
    PowerShell
  • License
    BSD 3-Clause "New...
  • Created over 7 years ago
  • Updated almost 5 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A collection of Red Team focused tools, scripts, and notes

Red Team Scripts


Red Team Scripts is a collection of red teaming related tools, scripts, techniques, and notes developed or discovered over time during engagements. Related tool release blog posts can be found at Threat Express an Information Security and Red Teaming Blog

Situational Awareness

Perform situational awareness on a local host or domain upon initial compromise.

enumerate.cna

Cobalt Strike Aggressor script function and alias to perform some rudimentary Windows host enumeration with Beacon built-in commands (i.e. no Powershell, binary calls, or process injection). Additionally, adds a basic enumerate alias for Linux based systems in SSH sessions.

Invoke-HostEnum

Author: Andrew Chiles (@andrewchiles) with code by harmj0y, Joe Bialek, rvrsh3ll, Beau Bullock, Tim Medin

A PowerShell v2.0 compatible script comprised of multiple system enumeration / situational awareness techniques collected over time. If system is a member of a Windows domain, it can also perform limited domain enumeration with the -Domain switch. However, domain enumeration is significantly limited with the intention that PowerView or BoodHound could also be used.

Enumerated Information:

  • OS Details, Hostname, Uptime, Installdate
  • Installed Applications and Patches
  • Network Adapter Configuration, Network Shares, Connections, Routing Table, DNS Cache
  • Running Processes and Installed Services
  • Interesting Registry Entries
  • Local Users, Groups, Administrators
  • Personal Security Product Status
  • Interesting file locations and keyword searches via file indexing
  • Interesting Windows Logs (User logins)
  • Basic Domain enumeration (users, groups, trusts, domain controllers, account policy, SPNs)

Privilege Escalation

Optionally performs Privilege Escalation functions from PowerUp in the PowerSploit project.

Empire 2.0 Integration

Use the accompanying hostenum.py script to include Invoke-HostEnum as post-exploitation situational awarness module in Empire. Both files need to be copied to the appropriate locations in Empire.

Credits:

Several functions are inspired or pulled directly from the following projects and are referenced in the code where applicable:

Usage

Refer to the help and comments in each script for detailed usage information.

License

This project and all individual scripts are under the BSD 3-Clause license

Links

threatexpress.com http://threatexpress.com/blogs/2018/hostenum-updates-usage/ http://threatexpress.com/blogs/2017/invoke-hostenum/

More Repositories

1

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide
1,434
star
2

domainhunter

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names
Python
1,418
star
3

random_c2_profile

Cobalt Strike random C2 Profile generator
Python
583
star
4

cs2modrewrite

Convert Cobalt Strike profiles to modrewrite scripts
Python
565
star
5

metatwin

The project is designed as a file resource cloner. Metadata, including digital signature, is extracted from one file and injected into another.
HTML
313
star
6

tinyshell

Python
161
star
7

aggressor-scripts

Cobalt Strike Aggressor Scripts
JavaScript
137
star
8

pasties

A collection of random bits of information common to many individual penetration tests, red teams, and other assessments
Shell
106
star
9

subshell

SubShell is a python command shell used to control and execute commands through HTTP requests to a webshell. SubShell acts as the interface to the remote webshells.
Python
73
star
10

threatbox

ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of ansible playbooks. Why Ansible? Why not? This seemed a natural evolution.
Smarty
69
star
11

invoke-pipeshell

SMB Named Pipe shell
PowerShell
62
star
12

portplow

PortPlow is a distributed port and system scanning & enumeration service. It enables the quick and automated enumeration of ports and services from multiple systems managed by a central console.
JavaScript
53
star
13

edc

Event Data Collector
Python
34
star
14

mythic2modrewrite

Generate Apache mod_rewrite rules for Mythic C2 profiles
Python
25
star
15

threat-mitigation

Threat Mitigation Strategies
22
star
16

procdot_sandbox

ProcDot Malware Sandbox
Python
19
star
17

cobaltstrike_payload_generator

Quickly generate every payload type for each listener and optionally host via HTTP.
13
star
18

threatexpress

HTML
11
star
19

redteamguide

Home of https://redteam.guide
JavaScript
9
star
20

tools

Tools
1
star