Tools of the Trade 专业工具

PowerView/SharpView
PowerView/ 锐普视图

A PowerShell tool and a .NET port of the same used to gain situational awareness in AD. These tools can be used as replacements for various Windows net* commands and more. PowerView and SharpView can help us gather much of the data that BloodHound does, but it requires more work to make meaningful relationships among all of the data points. These tools are great for checking what additional access we may have with a new set of credentials, targeting specific users or computers, or finding some "quick wins" such as users that can be attacked via Kerberoasting or ASREPRoasting.
PowerShell 工具和相同的 .NET 端口用于在 AD 中获取态势感知。这些工具可用作各种 Windows net* 命令等的替代品。PowerView 和 SharpView 可以帮助我们收集 BloodHound 所做的大部分数据，但需要更多的工作才能在所有数据点之间建立有意义的关系。这些工具非常适合检查我们使用一组新凭据可能拥有哪些额外访问权限，针对特定用户或计算机，或查找一些“快速获胜”，例如可以通过 Kerberoasting 或 ASREPRoasting 攻击的用户。

BloodHound  猎犬

Used to visually map out AD relationships and help plan attack paths that may otherwise go unnoticed. Uses the SharpHound PowerShell or C# ingestor to gather data to later be imported into the BloodHound JavaScript (Electron) application with a Neo4j database for graphical analysis of the AD environment.
用于直观地绘制 AD 关系并帮助规划可能被忽视的攻击路径。使用 SharpHound PowerShell 或 C# 摄取器收集数据，以便稍后通过 Neo4j 数据库导入 BloodHound JavaScript （Electron） 应用程序，以对 AD 环境进行图形分析。

SharpHound  锋利猎犬

The C# data collector to gather information from Active Directory about varying AD objects such as users, groups, computers, ACLs, GPOs, user and computer attributes, user sessions, and more. The tool produces JSON files which can then be ingested into the BloodHound GUI tool for analysis.
C# 数据收集器，用于从 Active Directory 收集有关各种 AD 对象（如用户、组、计算机、ACL、GPO、用户和计算机属性、用户会话等）的信息。该工具生成 JSON 文件，然后可以将其摄取到 BloodHound GUI 工具中进行分析。

BloodHound.py

A Python-based BloodHound ingestor based on the Impacket toolkit. It supports most BloodHound collection methods and can be run from a non-domain joined attack host. The output can be ingested into the BloodHound GUI for analysis.
基于 Python 的 BloodHound 摄取器，基于 Impacket 工具包 。它支持大多数 BloodHound 收集方法，并且可以从未加入域的攻击主机运行。输出可以摄取到 BloodHound GUI 中进行分析。

Kerbrute

A tool written in Go that uses Kerberos Pre-Authentication to enumerate Active Directory accounts, perform password spraying, and brute-forcing.
一种用 Go 编写的工具，它使用 Kerberos 预身份验证来枚举 Active Directory 帐户、执行密码喷洒和暴力破解。

Impacket toolkit  Impacket 工具包

A collection of tools written in Python for interacting with network protocols. The suite of tools contains various scripts for enumerating and attacking Active Directory.
用 Python 编写的用于与网络协议交互的工具集合。该工具套件包含用于枚举和攻击 Active Directory 的各种脚本。

Responder  答

Responder is a purpose-built tool to poison LLMNR, NBT-NS, and MDNS, with many different functions.
Responder 是一种专门构建的工具，用于毒害 LLMNR、NBT-NS 和 MDNS，具有许多不同的功能。

Inveigh.ps1

Similar to Responder, a PowerShell tool for performing various network spoofing and poisoning attacks.
与 Responder 类似，这是一种用于执行各种网络欺骗和中毒攻击的 PowerShell 工具。

C# Inveigh (InveighZero)
C# Inveigh （InveighZero）

The C# version of Inveigh with a semi-interactive console for interacting with captured data such as username and password hashes.
Inveigh 的 C# 版本，带有半交互式控制台，用于与捕获的数据（例如用户名和密码哈希）进行交互。

rpcinfo  RPC 信息

The rpcinfo utility is used to query the status of an RPC program or enumerate the list of available RPC services on a remote host. The "-p" option is used to specify the target host. For example the command "rpcinfo -p 10.0.0.1" will return a list of all the RPC services available on the remote host, along with their program number, version number, and protocol. Note that this command must be run with sufficient privileges.
rpcinfo 实用程序用于查询 RPC 程序的状态或枚举远程主机上可用 RPC 服务的列表。“-p”选项用于指定目标主机。例如，命令“rpcinfo -p 10.0.0.1”将返回远程主机上可用的所有 RPC 服务的列表，以及它们的程序号、版本号和协议。请注意，此命令必须以足够的权限运行。

rpcclient  RPC 客户端

A part of the Samba suite on Linux distributions that can be used to perform a variety of Active Directory enumeration tasks via the remote RPC service.
Linux 发行版上 Samba 套件的一部分，可用于通过远程 RPC 服务执行各种 Active Directory 枚举任务。

CrackMapExec (CME)  CrackMapExec （CME）

CME is an enumeration, attack, and post-exploitation toolkit which can help us greatly in enumeration and performing attacks with the data we gather. CME attempts to "live off the land" and abuse built-in AD features and protocols like SMB, WMI, WinRM, and MSSQL.
CME 是一个枚举、攻击和后利用工具包，可以极大地帮助我们使用收集的数据进行枚举和执行攻击。CME 试图“以土地为生”并滥用内置的 AD 功能和协议，如 SMB、WMI、WinRM 和 MSSQL。

Rubeus  鲁伯斯

Rubeus is a C# tool built for Kerberos Abuse.
Rubeus 是专为 Kerberos 滥用而构建的 C# 工具。

GetUserSPNs.py

Another Impacket module geared towards finding Service Principal names tied to normal users.
另一个 Impacket 模块，用于查找与普通用户绑定的服务主体名称。

Hashcat  哈希猫

A great hash cracking and password recovery tool.
一个很棒的哈希破解和密码恢复工具。

enum4linux  枚举 4Linux

A tool for enumerating information from Windows and Samba systems.
用于枚举来自 Windows 和 Samba 系统的信息的工具。

enum4linux-ng  枚举 4linux-ng

A rework of the original Enum4linux tool that works a bit differently.
对原始 Enum4linux 工具的返工，工作方式略有不同。

ldapsearch  LDAP 搜索

Built-in interface for interacting with the LDAP protocol.
用于与 LDAP 协议交互的内置接口。

windapsearch

A Python script used to enumerate AD users, groups, and computers using LDAP queries. Useful for automating custom LDAP queries.
用于使用 LDAP 查询枚举 AD 用户、组和计算机的 Python 脚本。对于自动执行自定义 LDAP 查询很有用。

DomainPasswordSpray.ps1  域密码喷雾.ps1

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
DomainPasswordSpray 是一种用 PowerShell 编写的工具，用于对域的用户执行密码喷射攻击。

LAPSToolkit

The toolkit includes functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).
该工具包包括用 PowerShell 编写的函数，这些函数利用 PowerView 来审核和攻击已部署 Microsoft 本地管理员密码解决方案 （LAPS） 的 Active Directory 环境。

smbmap  SMB 地图

SMB share enumeration across a domain.
跨域的 SMB 共享枚举。

psexec.py

Part of the Impacket toolkit, it provides us with Psexec-like functionality in the form of a semi-interactive shell.
作为 Impacket 工具包的一部分，它以半交互式 shell 的形式为我们提供了类似 Psexec 的功能。

wmiexec.py

Part of the Impacket toolkit, it provides the capability of command execution over WMI.
作为 Impacket 工具包的一部分，它提供了通过 WMI 执行命令的功能。

Snaffler  纳夫勒

Useful for finding information (such as credentials) in Active Directory on computers with accessible file shares.
对于在具有可访问文件共享的计算机上的 Active Directory 中查找信息（例如凭据）非常有用。

smbserver.py

Simple SMB server execution for interaction with Windows hosts. Easy way to transfer files within a network.
用于与 Windows 主机交互的简单 SMB 服务器执行。在网络内传输文件的简单方法。

setspn.exe

Adds, reads, modifies and deletes the Service Principal Names (SPN) directory property for an Active Directory service account.
添加、读取、修改和删除 Active Directory 服务帐户的服务主体名称 （SPN） 目录属性。

Mimikatz  米米卡茨

Performs many functions. Notably, pass-the-hash attacks, extracting plaintext passwords, and Kerberos ticket extraction from memory on a host.
执行许多功能。值得注意的是，传递哈希攻击、提取明文密码以及从主机上的内存中提取 Kerberos 票证。

secretsdump.py

Remotely dump SAM and LSA secrets from a host.
从主机远程转储 SAM 和 LSA 机密。

evil-winrm  邪恶-winrm

Provides us with an interactive shell on a host over the WinRM protocol.
通过 WinRM 协议在主机上为我们提供交互式 shell。

mssqlclient.py

Part of the Impacket toolkit, it provides the ability to interact with MSSQL databases.
作为 Impacket 工具包的一部分，它提供了与 MSSQL 数据库交互的能力。

noPac.py

Exploit combo using CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user.
使用 CVE-2021-42278 和 CVE-2021-42287 的漏洞利用组合来冒充标准域用户的 DA。

rpcdump.py

Part of the Impacket toolset, RPC endpoint mapper.
Impacket 工具集的一部分，RPC 终结点映射器。

CVE-2021-1675.py

Printnightmare PoC in python.
Python 中的 Printnightmare PoC。

ntlmrelayx.py

Part of the Impacket toolset, it performs SMB relay attacks.
作为 Impacket 工具集的一部分，它执行 SMB 中继攻击。

PetitPotam.py

PoC tool for CVE-2021-36942 to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.
CVE-2021-36942 的 PoC 工具，用于强制 Windows 主机通过 MS-EFSRPC EfsRpcOpenFileRaw 或其他函数向其他计算机进行身份验证。

gettgtpkinit.py

Tool for manipulating certificates and TGTs.
用于作证书和 TGT 的工具。

getnthash.py

This tool will use an existing TGT to request a PAC for the current user using U2U.
此工具将使用现有 TGT 为 U2U 的当前用户请求 PAC。

adidnsdump  阿登斯转储

A tool for enumerating and dumping DNS records from a domain. Similar to performing a DNS Zone transfer.
用于枚举和转储域中的 DNS 记录的工具。类似于执行 DNS 区域传输。

gpp-decrypt  gpp-解密

Extracts usernames and passwords from Group Policy preferences files.
从组策略首选项文件中提取用户名和密码。

GetNPUsers.py

Part of the Impacket toolkit. Used to perform the ASREPRoasting attack to list and obtain AS-REP hashes for users with the 'Do not require Kerberos preauthentication' set. These hashes are then fed into a tool such as Hashcat for attempts at offline password cracking.
Impacket 工具包的一部分。用于执行 ASREPRoasting 攻击，为设置了“不需要 Kerberos 预身份验证”的用户列出和获取 AS-REP 哈希值。然后，这些哈希值被输入到 Hashcat 等工具中，以尝试离线密码破解。

lookupsid.py

SID bruteforcing tool.  SID 暴力破解工具。

ticketer.py

A tool for creation and customization of TGT/TGS tickets. It can be used for Golden Ticket creation, child to parent trust attacks, etc.
用于创建和自定义 TGT/TGS 票证的工具。可用于金票创建、子对父信任攻击等。

raiseChild.py

Part of the Impacket toolkit, It is a tool for automated child to parent domain privilege escalation.
作为 Impacket 工具包的一部分，它是用于自动将子域升级到父域权限的工具。

Active Directory Explorer
Active Directory 资源管理器

Active Directory Explorer (AD Explorer) is an AD viewer and editor. It can be used to navigate an AD database and view object properties and attributes. It can also be used to save a snapshot of an AD database for offline analysis. When an AD snapshot is loaded, it can be explored as a live version of the database. It can also be used to compare two AD database snapshots to see changes in objects, attributes, and security permissions.
Active Directory 资源管理器 （AD 资源管理器） 是一个 AD 查看器和编辑器。它可用于导航 AD 数据库并查看对象属性和属性。它还可用于保存 AD 数据库的快照以供离线分析。加载 AD 快照后，可以将其作为数据库的实时版本进行浏览。它还可用于比较两个 AD 数据库快照，以查看对象、属性和安全权限的更改。

PingCastle  平堡

Used for auditing the security level of an AD environment based on a risk assessment and maturity framework (based on CMMI adapted to AD security).
用于根据风险评估和成熟度框架（基于适应 AD 安全性的 CMMI）审核 AD 环境的安全级别。

Group3r  3R 组

Group3r is useful for auditing and finding security misconfigurations in AD Group Policy Objects (GPO).
Group3r 可用于审核和查找 AD 组策略对象 （GPO） 中的安全错误配置。

ADRecon  AD 雷康

A tool used to extract various data from a target AD environment. The data can be output in Microsoft Excel format with summary views and analysis to assist with analysis and paint a picture of the environment's overall security state.
用于从目标 AD 环境中提取各种数据的工具。数据可以以 Microsoft Excel 格式输出，并带有摘要视图和分析，以协助分析并描绘环境的整体安全状态。