https://github.com/gunzf0x/logonscriptsscanner
Tool designed to detect Logon Scripts that could lead to Lateral Windows Movement
https://github.com/gunzf0x/logonscriptsscanner
bash bash-script ethical-hacking ethical-hacking-tools logon-script penetration-testing pentesting pentesting-tool pentesting-tools red-team windows windows-lateral-movement
Last synced: about 2 months ago
JSON representation
Tool designed to detect Logon Scripts that could lead to Lateral Windows Movement
- Host: GitHub
- URL: https://github.com/gunzf0x/logonscriptsscanner
- Owner: gunzf0x
- Created: 2025-02-11T04:54:24.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2025-02-11T05:21:58.000Z (over 1 year ago)
- Last Synced: 2025-02-11T06:23:02.734Z (over 1 year ago)
- Topics: bash, bash-script, ethical-hacking, ethical-hacking-tools, logon-script, penetration-testing, pentesting, pentesting-tool, pentesting-tools, red-team, windows, windows-lateral-movement
- Language: Shell
- Homepage:
- Size: 256 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# LogonScriptsScanner
A simple tool to analyze `NETLOGON` share and check if it can be abused to move laterally on Windows machines.
---
## Pre-requisites
1. We need a valid user of an Active Directory domain and its credentials (password in plain text).
2. This tools needs 4 other tools to work:
- `bloodyAD`
- `rpcclient`
- `smbcacls`
- `smbclient`
To install `bloodyAD` just execute in a terminal:
```shell-session
❯ sudo apt update -y
❯ sudo apt-get install libkrb5-dev -y
❯ pip3 install bloodyAD
```
or, under your own risk,
```shell-session
❯ pip3 install bloodyAD --break-system-packages
```
To install `rpcclient`, `smbcacls` and `smbclient` execute in a terminal:
```shell-session
sudo apt update -y && sudo apt install smbclient -y
```
## Usage
Use the credentials of a valid user in the domain to extract info about potential Logon Scripts that could lead to lateral movement:
```shell-session
❯ ./LogonScriptScanner.sh
```
For example:
```shell-session
❯ ./LogonScriptScanner.sh julio 'SecurePassJul!08' inlanefreight.local 10.129.71.7
```
---
## Disclaimer
Use this tool for ethical purposes only (: