flangvik / sharpcollection

Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

SharpCollection

Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

Is your favorite tool missing? Feel free to open an issue or DM me on twitter @Flangvik
Please note that Cobalt Strike's execute-assembly only accepts binaries compiled with the "Any CPU" configuration.

OpSec

Should I blindly deploy any of these binaries during real-life engagements?
F*ck no, always look through anything that you deploy on a client machine or network. Eg https://github.com/dnSpy/dnSpy
Deploying anything blindly from this repo should be reserved for Lab environments, VM's , HackTheBox, detection mapping, and so forth.

Azure DevOps?

Each night at 03:00 AM, the Azure DevOps pipeline checks for new commits to all repositories master branch. Branches with changes will be automatically fetched and compiled with different framework targets as well as architectures, before being pushed to this repo.

The pipeline can be found here: https://dev.azure.com/FlangvikDev/SharpRelease

Available builds

Tools \ .NET Framework	NET 4.0	NET 4.5	NET 4.7
ADCollector	✔️	✔️	✔️
ADCSPwn	✔️	✔️	✔️
ADSearch	❌	❌	✔️
ADFSDump	✔️	✔️	✔️
AtYourService	✔️	✔️	✔️
BetterSafetyKatz	✔️	✔️	✔️
Certify	✔️	✔️	✔️
EDD	✔️	✔️	✔️
ForgeCert	❌	✔️	✔️
DeployPrinterNightmare	✔️	✔️	✔️
Grouper2	✔️	✔️	✔️
Group3r	❌	✔️	✔️
KrbRelay	❌	❌	✔️
KrbRelayUp	❌	❌	✔️
InveighZero	✔️	✔️	✔️
LockLess	✔️	✔️	✔️
Moriarty	❌	✔️	✔️
PassTheCert	✔️	✔️	✔️
PurpleSharp	❌	✔️	✔️
Rubeus	✔️	✔️	✔️
RunAs	✔️	✔️	✔️
SafetyKatz	✔️	✔️	✔️
SauronEye	❌	❌	✔️
scout	✔️	✔️	✔️
SearchOutlook	✔️	✔️	✔️
Seatbelt	✔️	✔️	✔️
ShadowSpray	❌	❌	✔️
Sharp-SMBExec	✔️	✔️	✔️
SharpAllowedToAct	✔️	✔️	✔️
SharpAppLocker	❌	✔️	✔️
SharpBlock	✔️	✔️	✔️
SharpBypassUAC	✔️	✔️	✔️
SharpChisel	✔️	✔️	✔️
SharpChrome	✔️	✔️	✔️
SharpChromium	✔️	✔️	✔️
SharpCloud	✔️	✔️	✔️
SharpCOM	✔️	✔️	✔️
SharpCrashEventLog	✔️	✔️	✔️
SharpDir	✔️	✔️	✔️
SharpDoor	✔️	✔️	✔️
SharpDPAPI	✔️	✔️	✔️
SharpDump	✔️	✔️	✔️
SharpEDRChecker	✔️	✔️	✔️
SharpExec	✔️	✔️	✔️
SharPersist	✔️	✔️	✔️
SharpFiles	✔️	✔️	✔️
SharpFinder		✔️	✔️
SharpGPOAbuse	✔️	✔️	✔️
SharpHandler	✔️	✔️	✔️
SharpHose	❌	✔️	✔️
SharpHound	❌	❌	✔️
SharpKatz	✔️	✔️	✔️
SharpLaps	✔️	✔️	✔️
SharpMapExec	✔️	✔️	✔️
SharpMiniDump	✔️	✔️	✔️
SharpMove	✔️	✔️	✔️
SharpPrinter	❌	✔️	✔️
SharpNoPSExec	❌	❌	✔️
SharpRDP	❌	✔️	✔️
SharpReg	✔️	✔️	✔️
SharpSCCM	❌	❌	✔️
SharpSecDump	✔️	✔️	✔️
SharpShares	✔️	✔️	✔️
SharpSphere	❌	✔️	✔️
SharpSpray	✔️	✔️	✔️
SharpStay	✔️	✔️	✔️
SharpSvc	❌	❌	✔️
SharpSniper	✔️	✔️	✔️
SharpSQLPwn	✔️	✔️	✔️
SharpTask	✔️	✔️	✔️
SharpTokenFinder	❌	✔️	✔️
SharpUp	✔️	✔️	✔️
SharpView	❌	✔️	✔️
SharpWMI	✔️	✔️	✔️
SharpWebServer	✔️	✔️	✔️
SharpWifiGrabber	✔️	✔️	✔️
SharpZeroLogon	✔️	✔️	✔️
Shhmon	✔️	✔️	✔️
Snaffler	❌	✔️	❌
SqlClient	✔️	✔️	✔️
StandIn	✔️	✔️	✔️
StickyNotesExtract	✔️	✔️	✔️
SweetPotato	❌	✔️	✔️
ThunderFox	✔️	✔️	✔️
TruffleSnout	❌	✔️	✔️
TokenStomp	✔️	✔️	✔️
Watson	✔️	✔️	✔️
winPEAS	❌	✔️	✔️
WMIReg	✔️	✔️	✔️
Whisker	❌	❌	✔️

Sources / Credits

Links for all these amazing tools are below :) title @leechristensen

• ADCollector - C# tool to quickly extract valuable information from the Active Directory environment @dev-2null
• ADCSPwn - C# tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service. @bats3c
• ADSearch - C# tool to help query AD via the LDAP protocol @tomcarver16 (Only NET 4.7)
• ADFSDump - A C# tool to dump all sorts of goodies from AD FS. @FireEye
• AtYourService - C# .NET Assembly for Service Enumeration @mitchmoser
• BetterSafetyKatz - Fork of SafetyKatz dynamically fetches the latest Mimikatz, runtime patching signatures and PE loads Mimikatz into memory. @Flangvik
• Certify - C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS). @harmj0y @tifkin_
• EDD - Enumerate Domain Data is designed to be similar to PowerView but in .NET @FortyNorthSecurity
• ForgeCert - uses a stolen CA certificate + private key to forge certificates for arbitrary users. @tifkin_
• DeployPrinterNightmare - C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc @Flangvik
• Grouper2 - C# tool to help find security-related misconfigurations in Active Directory Group Policy. @mikeloss
• Group3r - C# tool to find vulnerabilities in AD Group Policy, but do it better than Grouper2 did. @mikeloss
• KrbRelay - C# Framework for Kerberos relaying @cube0x0
• KrbRelayUp - universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced @dec0ne
• LockLess - Allows for the copying of locked files. @GhostPack
• Moriarty - Enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows
• PassTheCert - Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through Schannel. @AlmondOffSec
• PurpleSharp - C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments. @mvelazc0
• Rubeus - C# toolset for raw Kerberos interaction and abuses. @GhostPack
• RunAs - Csharp and open version of windows builtin runas.exe. @splinter_code
• SafetyKatz - Combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader. @GhostPack
• SauronEye - C# search tool find specific files containing specific keywords (.doc, .docx, .xls, .xlsx). @_vivami
• scout - A .NET assembly for performing recon against hosts on a network . @jaredhaight
• SearchOutlook - C# tool to search through a running instance of Outlook for keywords @RedLectroid
• Seatbelt - Performs a number of security oriented host-survey "safety checks". @GhostPack
• ShadowSpray - A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain.
• Sharp-SMBExec - A native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script @checkymander
• SharpAllowedToAct - C# implementation of a computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) @pkb1s
• SharpAppLocker - C# port of the Get-AppLockerPolicy PS cmdlet with extended features @Flangvik
• SharpBlock - A method of bypassing EDR's active projection DLL's by preventing entry point exection. @CCob
• SharpBypassUAC - C# tool for UAC bypasses @rodzianko
• SharpChisel - C# Chisel Wrapper. @shantanu561993
• SharpChrome - Chrome-specific implementation of SharpDPAPI capable of cookies and logins decryption/triage. @GhostPack
• SharpChromium - C# Project to retrieve Chromium data, such as cookies, history and saved logins. @djhohnstein
• SharpCloud - Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute. @chrismaddalena
• SharpCrashEventLog - C# port of LogServiceCrash @slyd0g @limbenjamin
• SharpCOM - C# port of Invoke-DCOM @424f424f
• SharpDir - C# tool to search both local and remote file systems for files. @jnqpblc
• SharpDoor - C# tool to allow multiple RDP (Remote Desktop) sessions by patching termsrv.dll file. @infosecn1nja
• SharpDPAPI - C# port of some Mimikatz DPAPI functionality. @GhostPack
• SharpDump - SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality. @GhostPack
• SharpEDRChecker - C# tool to check for the presence of known defensive products such as AV's, EDR's and logging tools @PwnDexter
• SharPersist - C# persistence toolkit.
• SharpExec - SharpExec is an offensive security C# tool designed to aid with lateral movement. @anthemtotheego
• SharpFiles - C# tool to search for files based on SharpShares output. @fullmetalcache
• SharpFinder - Searches for files matching specific criteria on readable shares within the domain
• SharpGPOAbuse - SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO). @FSecureLABS
• SharpHandler - C# tool for stealing/duping handles to LSASS @Jean_Maes_1994
• SharpHose - Asynchronous Password Spraying Tool in C# for Windows Environments . @ustayready
• SharpHound - C# 2022 version of the BloodHound 4.x Ingestor. @BloodHoundAD
• SharpKatz - PURE C# port of significant MimiKatz functionality such as logonpasswords, dcsync, etc. @b4rtik
• SharpLaps - A C# tool to retrieve LAPS passwords from LDAP @pentest_swissky
• SharpMapExec - C# version of @byt3bl33d3r's tool CrackMapExec @cube0x0
• SharpMiniDump - C# tool to Create a minidump of the LSASS process from memory @b4rtik
• SharpNoPSExec - C# tool allowing file less command execution for lateral movement. @juliourena
• SharpMove - C# tool for performing lateral movement techniques @0xthirteen
• SharpPrinter - C# tool for discovering Printers on an network @424f424f
• SharpRDP - C# Remote Desktop Protocol Console Application for Authenticated Command Execution @0xthirteen
• SharpReg - C# tool to interact with the Remote Registry service api. @jnqpblc
• SharpSecDump - C# port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py @G0ldenGunSec
• SharpSCCM - C# utility for interacting with SCCM @_Mayyhem
• SharpShares - Enumerate all network shares in the current domain. @djhohnstein
• SharpSphere - C# SharpSphere has the ability to interact with the guest operating systems of virtual machines managed by vCenter. @jkcoote & @grzryc
• SharpSpray - C# tool to perform a password spraying attack against all users of a domain using LDAP. @jnqpblc
• SharpStay - .NET project for installing Persistence. @0xthirteen
• SharpSearch - C# Project to quickly filter through a file share for targeted files for desired information. @djhohnstein
• SharpSvc - C# tool to interact with the SC Manager API. @jnqpblc (Only NET 4.7)
• SharpSniper - SharpSniper is a simple tool to find the IP address of these users so that you can target their box. @hunniccyber
• SharpSQLPwn - C# tool to identify and exploit weaknesses within MSSQL instances in Active Directory environments. @lefayjey
• SharpTask - C# tool to interact with the Task Scheduler service api. @jnqpblc
• SharpTokenFinder - C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps
• SharpUp - C# port of various PowerUp functionality. @GhostPack
• SharpView - C# implementation of harmj0y's PowerView. @tevora-threat
• SharpWMI - C# implementation of various WMI functionality. @GhostPack
• SharpWebServer - A Red Team oriented simple HTTP & WebDAV server written in C# with functionality to capture Net-NTLM hashes. @mariuszbit
• SharpWifiGrabber - Sharp Wifi Password Grabber retrieves in clear-text the Wi-Fi Passwords from all WLAN Profiles saved on a workstation. @r3n_hat
• SharpZeroLogon - C# port of CVE-2020-1472 , a.k.a. Zerologon. @buffaloverflow
• Shhmon - Neutering Sysmon via driver unload. @Shhmon
• Snaffler - C# tool for pentesters to help find delicious candy. @l0ss and @Sh3r4
• SqlClient - C# .NET mssql client for accessing database data through beacon. @FortyNorthSecurity
• StandIn - C# based small AD post-compromise toolkit. @FuzzySec
• StickyNotesExtract - C# tool that extracts data from the Windows Sticky Notes database. @V1V1
• SweetPotato - Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019 . @CCob
• ThunderFox - C# Retrieves data (contacts, emails, history, cookies and credentials) from Thunderbird and Firefox. @V1V1
• TruffleSnout - C# based iterative AD discovery toolkit for offensive operators. @dsnezhkov
• TokenStomp - C# implementation of the token privilege removal flaw discovered by @GabrielLandau / Elastic. @Mrtn9
• Watson - Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities . @rasta-mouse
• winPEAS - PEASS - Privilege Escalation Awesome Scripts (winPEAS). @carlospolop
• WMIReg - C# PoC to interact with local/remote registry hives through WMI. @airzero24
• Whisker - Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute. @elad_shamir

sharpcollection's Issues

Inveigh Out of Date and Name Changed

It looks like the current version of Inveigh in SharpCollection is 0.913 which doesn't support several of the flags in the latest version, v2.0.10, such as -LLMNRTypes and specifying an IPv6 AAAA record with -DNSTypes.

Also, for the SharpCollection readme: InveighZero is now just called Inveigh, since the main version of the tool is now the C# version previously called InveighZero.

https://github.com/Kevin-Robertson/Inveigh

Thanks so much for making a great tool, I use it all the time!

[New Bin Request] - Moriarty

C# tool for identifying CVEs:

https://github.com/BC-SECURITY/Moriarty/

This is currently targeting NetFramework 4.7 but should work for at least 4.7

Request to Add GMSAPasswordReader

:) Thanks for your contributions @Flangvik we love SharpCollection.

Can you add GMSAPasswordReader?

https://github.com/rvazarkar/GMSAPasswordReader

Add ShadowSpray

https://github.com/ShorSec/ShadowSpray

Pipeline for NET 3.5

Would it be possible to include releases for NET 3.5 in the pipeline? In case it is not, is there any way to "clone" your azure pipeline config so I could try this on my own?

Add Sharp-SMBExec

Thoughts on adding https://github.com/checkymander/Sharp-SMBExec?

Add Whisker

Hi,

Awesome project! Can you add https://github.com/eladshamir/Whisker to it ?

Cheers,
PY

SharpLaps

Found another one that I have seen out there for the collection.

https://github.com/swisskyrepo/SharpLAPS

Thanks for doing this!

SharpBypassUAC

SharpBypassUAC would be a nice addition to the project

SpoolSample

Hi,

you mentioned "SpoolSample" in your "Sources / Credits" section but I couldn't find the executable in your repo.
Could you add this one?

Best regards

Add SharPersist

Any chance to include https://github.com/fireeye/SharPersist in the list?

[New Bin Request] - SharpFinder

SharpFinder is a C# tool for enumerating files matching specific criteria on readable shares within an Active Directory domain. It is inspired by @harmj0uy's Find-InterestingFile cmdlet, which is part of PowerSploit.

https://github.com/s0lst1c3/SharpFinder

SharpSpool

KrbRelay not updated.

Seems like KrbRelay isn't updated to it's latest version that incorporates aspects of remotepotato.

Add a few tools

https://github.com/V1V1/SharpScribbles - I don't see anything like StickyNotesExtract in the repo, and this implementation of "ThunderFox" seems to work really well
https://github.com/djhohnstein/SharpWeb - This is supposed to dump stuff from all the web browsers but it doesnt seem to work? Maybe it works on older versions of Chrome... Just putting this out there.
https://github.com/0xthirteen/SharpRDP - Remote Desktop Protocol Console Application for Authenticated Command Execution

Access to pipeline source code

First of all thanks for the effort put into this project!

As you state in the readme, the pipeline should be visible on the given link

The pipeline can be found here: https://dev.azure.com/FlangvikDev/SharpRelease

However, when accessing the link - even with authentication - it is not possible to review the pipeline runner's code.
Clicking through all the items does not give me the runner config.

I guess it is a configuration mistake, that the yml file is not publicly readable - please review your settings.

Kind regards.

Add SharpSQLPwn

Hello,
A shameless plug here:
Would you consider adding SharpSQLPwn: https://github.com/lefayjey/SharpSQLPwn ?
Thanks!

add SharpLeftOvers

want to add https://github.com/ceramicskate0/SharpLeftOvers?

[New Bin] Add SharpTokenFinder

Hello!

I have reimplemented TokenFinder in C# so now we can pwn Office Desktop Apps with impunity from the comfort of a reflective assembly! Would love to see it pulled into this repo.

https://github.com/HuskyHacks/SharpTokenFinder

The current build is for .NET 4.5 but I don't see any issue bumping it to 4.7 as well.

Thank you!

SharpHound Repositories

Based on the last compile date in your repository, I think you are using the SharpHound from here rather than from the supported version here. Could you update pipeline to use the supported version?

Love the repository, keep it up!!

Request to add Lsass Shtinkering

https://github.com/deepinstinct/Lsass-Shtinkering

Thanks :)

Request to add RunasCs

Recently found RunasCs to be very useful.

Could this tool be added to the collection?

https://github.com/antonioCoco/RunasCs

Change SQLClient

Could you update the current SQLClient project by this one https://github.com/daniel2005d/SQLClient/tree/main, as the current version lacks support.

I'm the creator of a new SQLClient program, and in the future, I will be adding more functionalities

Add GodPotato

Any chance you can add GodPotato: https://github.com/BeichenDream/GodPotato
Thanks so much!

Request to Add Snaffler

https://github.com/SnaffCon/Snaffler

Request to add - SharpLateral

Hi @Flangvik, thanks for your contributions; we love your repo and use it all the time.

Can you please check if you can add this project: https://github.com/mertdas/SharpLateral

could please add SharpMove ?

https://github.com/0xthirteen/SharpMove

Request to Add PassTheCert

• https://github.com/AlmondOffSec/PassTheCert

Relevant:

• https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html

Grouper2 no longer maintained

Suggest using Group3r.

https://github.com/Group3r/Group3r

Sharp collection

A small suggestion

How about adding the MD5/HASH value of the binary file?

SharpSCCM Not Working

I tested SharpSCCM on two non-domain joined Windows 10 systems (with Defender disabled) and was unable to get the tool working:

Add BadAssMacros

https://github.com/Inf0secRabbit/BadAssMacros