{"id":44347777,"url":"https://github.com/ghost-ng/slinger","last_synced_at":"2026-02-11T14:10:54.845Z","repository":{"id":214826086,"uuid":"730472744","full_name":"ghost-ng/slinger","owner":"ghost-ng","description":"An impacket-lite cli tool that combines many useful impacket functions using a single session.","archived":false,"fork":false,"pushed_at":"2026-01-13T04:27:27.000Z","size":27787,"stargazers_count":57,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-13T07:49:23.690Z","etag":null,"topics":["dce","impacket","rpc","smb"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ghost-ng.png","metadata":{"files":{"readme":"docs/README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-12-12T02:11:16.000Z","updated_at":"2026-01-13T04:27:31.000Z","dependencies_parsed_at":"2025-02-02T03:24:23.094Z","dependency_job_id":"fc31e381-e1a5-4ba3-8f1d-9b9b40ec9b5f","html_url":"https://github.com/ghost-ng/slinger","commit_stats":null,"previous_names":["ghost-ng/slinger"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/ghost-ng/slinger","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghost-ng%2Fslinger","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghost-ng%2Fslinger/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghost-ng%2Fslinger/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghost-ng%2Fslinger/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ghost-ng","download_url":"https://codeload.github.com/ghost-ng/slinger/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ghost-ng%2Fslinger/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29334157,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-11T14:07:45.431Z","status":"ssl_error","status_checked_at":"2026-02-11T14:07:45.080Z","response_time":97,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dce","impacket","rpc","smb"],"created_at":"2026-02-11T14:10:54.138Z","updated_at":"2026-02-11T14:10:54.838Z","avatar_url":"https://github.com/ghost-ng.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Slinger\n\n![Slinger](assets/image.png)\n\nSlinger is a versatile tool designed for advanced network interactions and manipulations, with a focus on the SMB protocol. It offers a range of functionalities for interacting with remote systems, including managing scheduled tasks, handling Windows Registry operations, service management and gathering system information - **all in a single session**.  Slinger is built on the impacket framework and should offer a similar feel to impacket functions.\n\n## Key Features\n\n### Core Capabilities\n- **🔌 Structured SMB Client** - Object-oriented SMB operations with intelligent session management\n- **♾️ Persistent Impacket Sessions** - Maintain connections across multiple operations without re-authenticating\n- **⚡ Multiple Command Execution Methods** - ATExec (Task Scheduler), WMI DCOM, WMI over SMB pipes, and cooperative agents\n- **🎯 User-Friendly Custom CLI** - Interactive shell with tab completion, command history, and intuitive syntax\n- **📚 Verbose Help Documentation** - Comprehensive help system with `help --verbose` for categorized command reference\n- **🔧 Consolidated Impacket Features** - Unified interface for SMB, RPC, WMI, registry, services, secrets dumping, and more\n- **🧩 Extensible Plugin System** - Easy-to-develop plugins for custom functionality\n\n### Windows Administration\n- **Registry Management** - Query, create, modify, and delete registry keys and values remotely\n- **Service Control** - Full lifecycle management of Windows services (create, start, stop, delete, configure)\n- **Task Scheduling** - Manage scheduled tasks via Task Scheduler\n- **Remote Process Lists** - Enumerate running processes with PID, PPID, priority, threads, and handles\n- **System Enumeration** - Logged-on users, shares, disks, network interfaces, named pipes\n- **Event Log Analysis** - Query and analyze Windows Event Logs\n- **Secrets Dumping** - Extract credentials via SAM/SYSTEM hives and LSA secrets\n\n### Advanced Features\n- **Cooperative Agent System** - Build polymorphic C++ agents with AES-256-GCM encryption and X25519 key exchange\n- **Resumable Downloads** - Large file transfers with automatic checkpoint recovery\n- **Command Chaining** - Execute command sequences from scripts or inline with semicolon separation\n- **Network Utilities** - Port forwarding rules, firewall enumeration, IP configuration\n- **Performance Monitoring** - Remote process enumeration and system metrics (experimental)\n\n## Demo\n\n[![asciicast](https://asciinema.org/a/nvpgBJ3lh6Z2xfg98jSFsOpvM.svg)](https://asciinema.org/a/nvpgBJ3lh6Z2xfg98jSFsOpvM)\n\n## Command Line Documentation\n\n[![CLI Documentation](assets/clidocs.jpg)](cli_menu.md)\n\n\n## Usage\n\n```bash\npython3 slinger.py -h\n\n      __,_____\n     / __.==--\"   SLINGER\n    /#(-'             v1.10.0\n    `-'                    a ghost-ng special\n\nusage: slinger.py [-h] --host HOST -u USERNAME -pass PASSWORD [-d DOMAIN] [-p PORT] [--nojoy] [--ntlm NTLM] [--kerberos] [--debug]\n\nimpacket swiss army knife (sort of)\n\noptions:\n  -h, --help            show this help message and exit\n  -host HOST            Host to connect to (default: None)\n  -user USERNAME, --username USERNAME\n                        Username for authentication (default: None)\n  -domain DOMAIN, --domain DOMAIN\n                        Domain for authentication (default: )\n  -port PORT            Port to connect to (default: 445)\n  -nojoy                Turn off emojis (default: False)\n  -pass [PASSWORD], --password [PASSWORD]\n                        Password for authentication (default: None)\n  -ntlm NTLM            NTLM hash for authentication (default: None)\n  -kerberos             Use Kerberos for authentication (default: False)\n  -debug                Turn on debug output (default: False)\n  -gen-ntlm-hash GEN_NTLM_HASH\n                        Generate NTLM hash from password (default: None)\n  -v, --version         Show version information\n```\n\nSlinger offers multiple authentication methods.  All methods are built on impacket functions and should therefore function the same.  *Warnining* at this time kerberos login has not been tested.\n\n### Login with password\n\n```bash\npython3 slinger.py --host 192.168.177.130 --username admin --password admin\n\n      __,_____\n     / __.==--\"   SLINGER\n    /#(-'             v1.10.0\n    `-'                    a ghost-ng special\n\n[*] Connecting to 192.168.177.130:445...\n[+] Successfully logged in to 192.168.177.130:445\n\nStart Time: 2023-12-30 23:46:00.651408\n\n[*] Checking the status of the RemoteRegistry service\n[*] Service RemoteRegistry is in stopped state\n[*] Trying to start RemoteRegistry service\n[+] Remote Registry service started\n[+] Successfully logged in to 192.168.177.130:445\n🤠 (192.168.177.130):\u003e exit\n[*] Remote Registy state restored -\u003e STOPPED\n\nStop Time: 2023-12-30 23:46:09.633701\n```\n\n### Login with NTLM\n\n```bash\npython3 slinger.py --host 10.0.0.28 --username Administrator --ntlm :5E119EC7919CC3B1D7AD859697CFA659\n\n      __,_____\n     / __.==--\"   SLINGER\n    /#(-'             v1.10.0\n    `-'                    a ghost-ng special\n\n[*] Connecting to 10.0.0.28:445...\n[+] Successfully logged in to 10.0.0.28:445\n\nStart Time: 2023-12-30 23:42:15.410337\n\n[*] Checking the status of the RemoteRegistry service\n[*] Service RemoteRegistry is in stopped state\n[*] Trying to start RemoteRegistry service\n[+] Remote Registry service started\n[+] Successfully logged in to 10.0.0.28:445\n🤠 (10.0.0.28):\u003e exit\n[*] Remote Registy state restored -\u003e STOPPED\n\nStop Time: 2023-12-30 23:42:19.886846\n```\n\n### Available Commands\n\n```bash\nAvailable commands:\n------------------------------------------\n!                     env                   regcreate             showtask\n#shell                eventlog              regdel                svcadd\nagent                 exit                  regquery              svccreate\natexec                find                  regset                svcdelete\naudit                 fwrules               regstart              svcdisable\ncat                   get                   regstop               svcenable\ncd                    hashdump              reguse                svcenum\nclear                 help                  reload                svcshow\nconfig                history               rm                    svcstart\ndebug-availcounters   hostname              rmdir                 svcstop\ndebug-counter         ifconfig              run                   taskadd\ndisableservice        info                  secretsdump           taskcreate\ndisablesvc            ipconfig              servertime            taskdel\ndownload              logoff                serviceadd            taskdelete\ndownloads             logout                servicecreate         taskenum\nenableservice         ls                    servicedel            taskexec\nenablesvc             mget                  servicedelete         tasklist\nenumdisk              mkdir                 servicedisable        taskrm\nenuminfo              network               serviceenable         taskrun\nenuminterfaces        plugins               servicerun            tasksenum\nenumlogons            portfwd               services              taskshow\nenumpipes             procs                 servicesenum          tasksshow\nenumservices          ps                    serviceshow           time\nenumshares            put                   servicestart          upload\nenumsys               pwd                   servicestop           use\nenumtasks             quit                  set                   who\nenumtime              reconnect             shares                wmiexec\nenumtransport         regcheck              showservice\n\nType help \u003ccommand\u003e or \u003ccommand\u003e -h for more information on a specific command\nType help --verbose for detailed categorized help\n```\n\n#### Click here to view all the help entries:\n[Help Entries](cli_menu.md)\n\n\n### Command Chaining\nSlinger has two ways to execute a sequence of commands.\n\n- Run a command chain through the CLI:\n    run -c \"cmd1;cmd2;cmd3\"\n- Run a series of commands from a script file, one command per line\n    cmd1\n    cmd2\n    cmd3\n\n```bash\nrun -h\nusage: slinger run [-h] (-c CMD_CHAIN | -f FILE)\n\nRun a slinger script or command sequence\n\noptions:\n  -h, --help            show this help message and exit\n  -c CMD_CHAIN, --cmd_chain CMD_CHAIN\n                        Specify a command sequence to run\n  -f FILE, --file FILE  Specify a script file to run\n\nExample Usage: run -c|-f [script]\n```\n\n\n## Plugins\n\n**System Audit** by [ghost-ng](https://github.com/ghost-ng/)\n\n## Installation\n\n### Development Installation\n```bash\ngit clone https://github.com/ghost-ng/slinger.git\ncd slinger\npipx install .\n```\n\n### Agent Build Dependencies\n\nTo build cooperative agents, install the following dependencies:\n\n**Required:**\n- CMake 3.15+\n- MinGW-w64 cross-compiler (`x86_64-w64-mingw32-g++`, `i686-w64-mingw32-g++`)\n\n**Automated Installation (Linux/macOS):**\n```bash\npython scripts/install_agent_deps.py\n```\n\n**Manual Installation:**\n\n*Ubuntu/Debian:*\n```bash\nsudo apt update \u0026\u0026 sudo apt install cmake build-essential mingw-w64\n```\n\n*CentOS/RHEL:*\n```bash\nsudo yum groupinstall \"Development Tools\" \u0026\u0026 sudo yum install cmake mingw64-gcc-c++\n```\n\n*Fedora:*\n```bash\nsudo dnf groupinstall \"Development Tools\" \u0026\u0026 sudo dnf install cmake mingw64-gcc-c++\n```\n\n*macOS:*\n```bash\nbrew install cmake mingw-w64\n```\n\n## Cooperative Agent System\n\nSlinger includes a polymorphic C++ agent system for secure command execution over named pipes via SMB.\n\n### Key Features\n- **Polymorphic builds** - Unique binary signatures per build with obfuscation\n- **Encrypted communication** - AES-256-GCM with X25519 key exchange\n- **SMB transport** - Named pipes over TCP 445 only\n- **Cross-architecture** - Windows x86/x64 support\n- **Lifecycle management** - Deploy, execute, check, kill, remove agents\n\n### Quick Start\n\n**Deploy and use:**\n```bash\n🤠 (10.0.0.28):\u003e use C$\n🤠 (10.0.0.28):\\\\C$\u003e agent deploy --agent x64 --deploy-method wmi\n🤠🔥 (10.10.10.161):\\\\c$\u003e agent use svchost_92qqjcem\n[*] Agent Information:\n  ID: svchost_92qqjcem\n  Host: 10.10.10.161\n  Name: svchost_92qqjcem.exe\n  Path: C:\\Windows\\svchost_92qqjcem.exe\n  Pipe: \\\\10.10.10.161\\pipe\\slinger\n  PPID: 3100 (parent process)\n[*] Connecting to agent: svchost_92qqjcem\n[*] Timeout: 30 seconds\n[+] Starting interactive session with agent svchost_92qqjcem\n[*] Pipe Name: slinger\n[*] Connecting to pipe: \\\\10.10.10.161\\pipe\\slinger\n[+] Connected to agent pipe\n[*] 🔐 Performing passphrase authentication...\n[+] ✓ Authentication successful - all communications encrypted\n[*] ╔══════════════════════════════════════════╗\n[*] ║        AGENT INTERACTIVE SHELL           ║\n[*] ╚══════════════════════════════════════════╝\nAgent ID: svchost_92qqjcem\nHost: 10.10.10.161\nPipe: slinger\n\n[*] Type 'exit' to close the connection\n[*] Type 'help' for agent commands\n\nagent:svchost_92qqjcem:C:\\\u003e whoami\nhtb\\administrator\n\nagent:svchost_92qqjcem:C:\\\u003e\n\n```\n\n**Cleanup:**\n```bash\n🤠 (10.0.0.28):\\\\C$\u003e agent reset  # Kill and remove all agents\n```\n\n**See it in action:**\n- [Agent Demo Video](agent_demo.md) - Watch the cooperative agent system in action\n\nFor detailed documentation, run:\n```bash\n🤠 (10.0.0.28):\u003e agent -h\n```\n\n\n## TODO\n\n- see TODO.md\n\n## Contributing\n\n### Creating Your Own Plugin for Slinger\n\nContributions to the Slinger project, particularly in the form of plugins, are highly appreciated. If you're interested in developing a plugin, here's a guide to help you get started:\n\n#### 1. Set Up Your Development Environment\n\n- Fork the [Slinger repository](https://github.com/ghost-ng/slinger) and clone it to your local machine.\n- Set up a Python development environment and install any necessary dependencies.\n\n#### 2. Create a New Plugin\n\n- Go to the `slinger/plugins` directory in your local repository.\n- Create a new Python file for your plugin, e.g., `my_plugin.py`.\n- Begin by importing the required modules, including the base plugin class:\n\n  ```python\n  from slinger.lib.plugin_base import PluginBase\n  ```\n\n#### 3. Develop Your Plugin\n\n- Your plugin class should inherit from `PluginBase`.\n- Implement the `get_parser` method to define the command-line interface for your plugin:\n\n  ```python\n  class MyPlugin(PluginBase):   \u003c--required\n      def get_parser(self):   \u003c--required\n        parser = argparse.ArgumentParser(add_help=False)   \u003c--required\n        subparsers = parser.add_subparsers(dest='command')   \u003c--required\n        plugincmd_parser = subparsers.add_parser(\"plugincmd\", help=\"My plugin subparser\")   \u003c--required\n        plugincmd_parser.add_argument(\"--plugincmd\", help=\"My plugin argument\")\n        plugincmd_parser.set_defaults(func=self.run)   \u003c--required\n        return parser   \u003c--required\n  ```\n\n- The `run` method can be used as an entry point for your plugin's functionality. It should be defined to handle the plugin's core logic.  Whatever the function name, it should be the same name as the function you added in the parser's \"set_defaults\" and it should accept \"args\" as a function parameter.\n\n  ```python\n  def run(self, args):\n      # Your plugin's core functionality goes here\n  ```\n\n- Add any additional methods or attributes necessary for your plugin.\n- **View the example plugin for additional help** [System Audit](../src/slingerpkg/plugins/system_audit.py)\n\n#### 4. Test Your Plugin\n\n- Place your plugin in the ~/.slinger/plugin directory Thoroughly test your plugin to ensure it functions correctly and integrates seamlessly with Slinger.\n- Ensure your plugin adheres to the coding standards and conventions of the project.\n\n#### 5. Document Your Plugin\n\n- Provide clear documentation for your plugin, detailing its purpose, usage, and any other important information.\n- Update the `README.md` or other relevant documentation to include your plugin's details.\n\n#### 6. Submit a Pull Request\n\n- Once your plugin is complete and tested, push your changes to your fork and create a pull request to the main Slinger repository.\n- Describe your plugin's functionality and any other pertinent details in your pull request.\n\n### General Guidelines\n\n- Write clean, well-documented code that follows the project's style guidelines.\n- If applicable, write tests for your code.\n- Keep pull requests focused – one feature or fix per request is ideal.\n\n## Disclaimer\n\nPlease note that this software is provided as-is, and while we strive to ensure its quality and reliability, we cannot guarantee its performance under all circumstances. The authors and contributors are not responsible for any damage, data loss, or other issues that may occur as a result of using this software. Always ensure you have a backup of your data and use this software at your own risk.\n\nAny likeness to other software, either real or fictitious, is purely coincidental unless otherwise stated. This software, unless otherwise stated, is unique and developed independently, and any similarities are not intended to infringe on any rights of the owners of similar software.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghost-ng%2Fslinger","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fghost-ng%2Fslinger","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghost-ng%2Fslinger/lists"}