Duane Michael

Jailbreaker-CE. Jailbreaker is a local evaluation tool for testing chatbot and agent-style systems against jailbreak, prompt-injection, and related failure modes.

ynab-mcp-server. YNAB MCP server with custom skills

ludus_sccm. An Ansible collection that installs an SCCM deployment with optional configurations.

LDAP-Bof-Collection. Collection of many ldap bofs for domain enumeration and privilege escalation. Created for use with the Adaptix C2.

ghostsurf. NTLM HTTP relay tool with SOCKS proxy for browser session hijacking

flare-learning-hub. Free educational content on reverse engineering and malware analysis from the FLARE team

WhoYouCalling. Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.

python-wcfbin. A python library for converting between WCF binary xml and plain xml.

BloodHoundOperator. BloodHound PowerShell client

printerbugnew. The DCERPC only printerbug.py version

bhopengraph. A python library to create BloodHound OpenGraphs

tiny11builder. Scripts to build a trimmed-down Windows 11 image.

fustercluck. POC tool to abuse windows server failover clusters

BASIC-M6502. Microsoft BASIC for 6502 Microprocessor - Version 1.1

AzADServicePrincipalInsights. Insights and change tracking on Microsoft Entra ID Service Principals (Enterprise Applications, Applications and Managed Identities)

InsideOLE. Companion code for Inside OLE 2nd Edition, published in 1995

RAIWhateverTrigger. Local SYSTEM auth trigger for relaying - X

pyenv. Simple Python version management

pyenv-virtualenv. a pyenv plugin to manage virtualenv (a.k.a. python-virtualenv)

roadtools_hybrid. Hybrid AD utilities for ROADtools

mprecon. a small script to collect information from a management point

SharpSuccessor. SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai.

bloodhound_mcp. A Model Context Protocol (MCP) server to converse with data in Bloodhound

FaceDancer. FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loading

Misconfiguration-Manager. Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

bbot. The recursive internet scanner for hackers. 🧡

SCCMVNC. A tool to modify SCCM remote control settings on the client machine, enabling remote control without permission prompts or notifications. This can be done without requiring access to SCCM server.

Invoke-RunAsWithCert. A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.

LocalKdc. Info on how to use Kerberos KDC on a non-domain joined host

apeman. AWS Attack Path Management Tool - Walking on the Moon

FalconHound. FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.

lsa-whisperer. Tools for interacting with authentication packages using their individual message protocols

GptHidra. GptHidra is a Ghidra plugin that uses the OpenAI Chat GPT to explain functions. With GptHidra, you can easily understand the purpose and behavior of functions in your codebase. Now with GPT4 Support!

Gepetto. IDA plugin which queries language models to speed up reverse-engineering

tiny_tracer. A Pin Tool for tracing API calls etc

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

pxethiefy. Python

Certify. Active Directory certificate abuse.

sccmhunter. SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain.

SMBLibrary. Free, Open Source, User-Mode SMB 1.0/CIFS, SMB 2.0, SMB 2.1 and SMB 3.0 server and client library

nt5src. Source code of Windows XP (NT5). Leaks are not from me. I just extracted the archive and cabinet files.

BloodHound. Six Degrees of Domain Admin

AADInternals. AADInternals PowerShell module for administering Azure AD and Office 365

dnSpy. Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

Active-Directory-Spotlights. PowerShell

PXEThief. PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager

adidnsdump. Active Directory Integrated DNS dumping by any authenticated user

AutomatedLab. AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.

CrucibleC2. A C# Command & Control framework

Blackbone. Windows memory hacking library

windbg-cheat-sheet. My personal cheat sheet for using WinDbg for kernel debugging

SilkETW. C#

sliver. Adversary Emulation Framework

PipeViewer. A tool that shows detailed information about named pipes in Windows

krabsetw. KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

Coercer. A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

Crassus. C#

RPCMon. RPC Monitor tool based on Event Tracing for Windows

sccmwtf. Python

InterProcessCommunication-Samples. Some Code Samples for Windows based Inter-Process-Communication (IPC)

windows-coerced-authentication-methods. A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.

ROADtools. A collection of Azure AD/Entra tools for offensive and defensive security purposes

flare-wmi. C++

SharpHandler. C#

SysWhispers3. SysWhispers on Steroids - AV/EDR evasion via direct system calls.

ElusiveMice. Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind

BokuLoader. A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

ShellcodeFluctuation. An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

dnMerge. A lightweight .NET assembly dependency merger that uses dnLib and 7zip's LZMA SDK for compressing dependant assemblies.

Certipy. Tool for Active Directory Certificate Services enumeration and abuse

LdapSignCheck. Beacon Object File & C# project to check LDAP signing

ADExplorerSnapshot. ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON.

SharpSCCM. A C# utility for interacting with SCCM

dnlib. Reads and writes .NET assemblies and modules

ConfigMgr. Microsoft Endpoint Configuration Manager scripts and tools

LdapRelayScan. Check for LDAP protections regarding the relay of NTLM authentication

noPac. CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.

Windows-APT-Warfare. 著作《Windows APT Warfare：惡意程式前線戰術指南》各章節技術實作之原始碼內容

KrbRelay. Framework for Kerberos relaying

WinDbg-Samples. Sample extensions, scripts, and API uses for WinDbg.

Advanced-Process-Injection-Workshop. C++

infosec-presentations. A repository of previous info-sec presentations I've presented.

MSRPC-to-ATTACK. A repository that maps commonly used attacks using MSRPC protocols to ATT&CK

Random. Assorted scripts and one off things

Powermad. PowerShell MachineAccountQuota and DNS exploit tools

stats. macOS system monitor in your menu bar

rpcfirewall. C++

Win10SysProgBookSamples. Windows 10 System Programming book samples

SharpAdidnsdump. c# implementation of Active Directory Integrated DNS dumping (authenticated user)

KernelObjectView. View handles and object for each object type

syllabi.

WebclientServiceScanner. Python tool to Check running WebClient services on multiple targets based on @leechristensen

PKINITtools. Tools for Kerberos PKINIT and relaying to AD CS

GetWebDAVStatus. Determine if the WebClient Service (WebDAV) is running on a remote system

gitignore. A collection of useful .gitignore templates

MalwareSourceCode. Collection of malware source code for a variety of platforms in an array of different programming languages.

kekeo. A little toolbox to play with Microsoft Kerberos in C

PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

awesome-linux-rootkits. a summary of linux rootkits published on GitHub

Hyper-V-Internals. Internals information about Hyper-V

volatility3. Volatility 3.0 development

illustrated-tls13. The Illustrated TLS 1.3 Connection: Every byte explained

NoMSBuild. MSBuild without MSbuild.exe

SigFlip. SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

PortBender. TCP Port Redirection Utility

DivertTCPconn. A TCP packet diverter for Windows platform

reactos. A free Windows-compatible Operating System

WMIReg. PoC to interact with local/remote registry hives through WMI

SharpSphere. .NET Project for Attacking vCenter

Legacy-AzureHound.ps1. PowerShell

SharpHide. Tool to create hidden registry keys.

DInvoke. Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

MicrosoftWontFixList. A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 (and SpoolSample ;-))

ExploitDotNetDCOM. A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET.

StandIn. StandIn is a small .NET35/45 AD post-exploitation toolkit

DSInternals. Directory Services Internals (DSInternals) PowerShell Module and Framework

Whisker. Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.

osed-scripts. bespoke tooling for offensive security's Windows Usermode Exploit Dev course (OSED)

awesome-cheatsheets. 👩‍💻👨‍💻 Awesome cheatsheets for popular programming languages, frameworks and development tools. They include everything you should know in one single file.

SysWhispers2. AV/EDR evasion via direct system calls.

WindowsInternals. Yet another windows internals repo

charlotte. c++ fully undetected shellcode launcher ;)

modern-cpp-tutorial. 📚 Modern C++ Tutorial: C++11 to C++26 On the Fly | https://changkun.de/modern-cpp/

defcon_27_windbg_workshop. DEFCON 27 workshop - Modern Debugging with WinDbg Preview

defcon27_csharp_workshop. Writing custom backdoor payloads with C# - Defcon 27 Workshop

GhostBuild. GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects

WhatWeb. Next generation web scanner

acCOMplice. Tools for discovery and abuse of COM hijacks

C-Reverse-Shell. a simple c++ reverse shell for windows

COMProxy. PoC for proxying COM objects when hijacking

BadBlood. BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

vulnerable-AD. Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab

Blacksmith. Building environments to replicate small networks and deploy applications

Mystikal. macOS Initial Access Payload Generator

NtCall64. Windows NT x64 syscall fuzzer

jenkins-attack-framework. Python

awesome-incident-response. A curated list of tools for incident response

PPLdump. Dump the memory of a PPL with a userland exploit

LAPSToolkit. Tool to audit and attack LAPS environments

StandIn. StandIn is a small .NET35/45 AD post-exploitation toolkit

p0wnedShell. PowerShell Runspace Post Exploitation Toolkit

SCShell. Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

HostRecon. This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users, and domain information. It does not use any 'net', 'ipconfig', 'whoami', 'netstat', or other system commands to help avoid detection.

GadgetToJScript. A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

NamedPipePTH. Pass the Hash to a named pipe for token Impersonation

krbrelayx. Kerberos relaying and unconstrained delegation abuse toolkit

ESC. Evil SQL Client (ESC) is an interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features. While ESC can be a handy SQL Client for daily tasks, it was originally designed for targeting SQL Servers during penetration tests and red team engagements. The intent of the project is to provide an .exe, but also sample files for execution through mediums like msbuild and PowerShell.

DAFT. DAFT: Database Audit Framework & Toolkit

RdpThief. Extracting Clear Text Passwords from mstsc.exe using API Hooking.

blackhat-python3. Source code for the book "Black Hat Python" by Justin Seitz. The code has been fully converted to Python 3, reformatted to comply with PEP8 standards and refactored to eliminate dependency issues involving the implementation of deprecated libraries.

JXA-Cookbook. Cookbook for JavaScript for Automation in Mac OS X Yosemite

HealthInspector. JXA situational awareness helper by simply reading specific files on a filesystem

cliProxy. Proxy Unix applications in the terminal

ghidra_scripts. Ghidra scripts such as a RC4 decrypter, Yara search, stack string decoder, etc.

ghidra-data. Supporting Data Archives for Ghidra

phishcatch. A browser extension and API server for detecting corporate password use on external websites

Reverse-Engineering. A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.

at-ps. Adversary Tactics - PowerShell Training

EvilClippy. A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

oletools. oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

DidierStevensSuite. Please no pull requests for this repository. Thanks!

ViperMonkey. A VBA parser and emulation engine to analyze malicious macros.

Security-Datasets. Re-play Security Events

kernel-fuzzer-for-xen-project. Kernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL

gobuster. Directory/File, DNS and VHost busting tool written in Go

ConfuserEx. An open-source, free protector for .NET applications

BOF.NET. A .NET Runtime for Cobalt Strike's Beacon Object Files

SharpSniper. Find specific users in active directory via their username and logon IP address

DotNetToJScript. A tool to create a JScript file which loads a .NET v2 assembly from memory.

SysmonCommunityGuide. TrustedSec Sysinternals Sysmon Community Guide

SharpWMI. SharpWMI is a C# implementation of various WMI functionality.

awesome-windows-kernel-security-development. windows kernel security development

awesome-python. An opinionated list of Python frameworks, libraries, tools, and resources

dnSpy. .NET debugger and assembly editor

pdfs. Technically-oriented PDF Collection (Papers, Specs, Decks, Manuals, etc)

inside-com. CD-ROM contents accompanying Dale Rogerson's Inside COM book.

windows-nt-file-system-internals-book. Source code on the 1.44MB 3.5 floppy accompanying the Windows NT File System Internals book.

SharpDPAPI. SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

PowerUpSQL. PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

byeintegrity7-uac. C++

Awesome-CobaltStrike-Defence. Defences against Cobalt Strike

PowerForensics. PowerForensics provides an all in one platform for live disk forensic analysis

Experienced-Pentester-OSEP.

ShellcodeWrapper. Shellcode wrapper with encryption for multiple target languages

PEzor. Open-Source Shellcode & PE Packer

github1s. One second to read GitHub code with VS Code.

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

BOFs. Collection of Beacon Object Files

endgame. An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈

SharpGPOAbuse. SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

SharpHound3. C# Data Collector for the BloodHound Project, Version 3

BloodHound-Tools. Miscellaneous tools for BloodHound

ElevateKit. The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

injection. C++

flare-ida. IDA Pro utilities from FLARE team

windows-operating-system-archaeology. windows-operating-system-archaeology @Enigma0x3 @subTee

SharpStay. .NET project for installing Persistence