Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/juliourena/SharpNoPSExec
Get file less command execution for lateral movement.
https://github.com/juliourena/SharpNoPSExec
Last synced: 21 days ago
JSON representation
Get file less command execution for lateral movement.
- Host: GitHub
- URL: https://github.com/juliourena/SharpNoPSExec
- Owner: juliourena
- License: gpl-3.0
- Created: 2021-04-24T22:02:38.000Z (over 3 years ago)
- Default Branch: master
- Last Pushed: 2022-06-03T10:32:55.000Z (over 2 years ago)
- Last Synced: 2024-08-05T17:26:38.828Z (4 months ago)
- Language: C#
- Size: 3.49 MB
- Stars: 594
- Watchers: 12
- Forks: 88
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
- awesome-hacking-lists - juliourena/SharpNoPSExec - Get file less command execution for lateral movement. (C# #)
README
# SharpNoPSExec
#### File less command execution for lateral movement.
SharpNoPSExec will query all services and randomly pick one with a start type disable or manual, the current status stopped and with LocalSystem privileges to reuse them.
Once it select the service it will save its current state, replace the binary path with the payload of your choise and execute it.
After waiting 5 seconds it will restore the service configuration and you mostlikely will have your shell :)
This tool is inspired on PSExec explanation from #OSEP for lateralmovement, while reading the exercise I realized I can perform the lateralmovement without touching disk and without creating a new service to avoid detection.
```
███████╗██╗ ██╗ █████╗ ██████╗ ██████╗ ███╗ ██╗ ██████╗ ██████╗ ███████╗███████╗██╗ ██╗███████╗ ██████╗
██╔════╝██║ ██║██╔══██╗██╔══██╗██╔══██╗████╗ ██║██╔═══██╗██╔══██╗██╔════╝██╔════╝╚██╗██╔╝██╔════╝██╔════╝
███████╗███████║███████║██████╔╝██████╔╝██╔██╗ ██║██║ ██║██████╔╝███████╗█████╗ ╚███╔╝ █████╗ ██║
╚════██║██╔══██║██╔══██║██╔══██╗██╔═══╝ ██║╚██╗██║██║ ██║██╔═══╝ ╚════██║██╔══╝ ██╔██╗ ██╔══╝ ██║
███████║██║ ██║██║ ██║██║ ██║██║ ██║ ╚████║╚██████╔╝██║ ███████║███████╗██╔╝ ██╗███████╗╚██████╗
╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝╚══════╝ ╚═════╝
Version: 0.0.3
Author: Julio Ureña (PlainText)
Twitter: @juliourena
SharpNoPSExec.exe --target=192.168.56.128 --payload=""c:\windows\system32\cmd.exe /c powershell -exec bypass -nop -e ZQBjAGgAbwAgAEcAbwBkACAAQgBsAGUAcwBzACAAWQBvAHUAIQA=""
Required Arguments:
--target= - IP or machine name to attack.
--payload= - Payload to execute in the target machine.
Optional Arguments:
--username= - Username to authenticate to the remote computer.
--password= - Username's password.
--domain= - Domain Name, if no set a dot (.) will be used instead.
--service= - Service to modify to execute the payload, after the payload is completed the service will be restored.
Note: If not service is specified the program will look for a random service to execute.
Note: If the selected service has a non-system account this will be ignored.
--help - Print help information.
```
### Pass the hash Example
https://user-images.githubusercontent.com/29603107/119263799-7d8c9180-bbae-11eb-9f3f-6f272bb8bcd6.mp4
#### Version 0.0.3
- Added - Sanitization to the input.
- Fixed - Payload it's working with Covenant in a non-interactive.
- Changed - Exit function is a return, removed Enviroment.Exit(0).
- Changed - Logic improvements.
#### Version 0.0.2
- Fixed - Parsing payload, powershell commands wont execute if they have =.
- Changed - Error handling.
#### Version 0.0.1
- First release.