https://github.com/tokyoneon/CredPhish

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.
https://github.com/tokyoneon/CredPhish

amsi antivirus-evasion backdoor bypass-antivirus c2 dns dns-server exfiltration information-security kali kali-linux kali-scripts offensive-security penetration-testing reverse-shell shell social-engineering

Last synced: about 1 month ago
JSON representation

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.

• Host: GitHub
• URL: https://github.com/tokyoneon/CredPhish
• Owner: tokyoneon
• Created: 2021-07-27T04:07:54.000Z (about 3 years ago)
• Default Branch: master
• Last Pushed: 2021-07-27T14:26:00.000Z (about 3 years ago)
• Last Synced: 2024-04-13T12:48:37.641Z (5 months ago)
• Topics: amsi, antivirus-evasion, backdoor, bypass-antivirus, c2, dns, dns-server, exfiltration, information-security, kali, kali-linux, kali-scripts, offensive-security, penetration-testing, reverse-shell, shell, social-engineering
• Language: PowerShell
• Homepage: https://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell/
• Size: 300 KB
• Stars: 277
• Watchers: 5
• Forks: 44
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - tokyoneon/CredPhish - CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS. (PowerShell)

README

        
![](images/credphish.gif)

CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on [CredentialPicker](https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.ui.credentialpicker?view=winrt-19041) to collect user passwords, [Resolve-DnsName](https://docs.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname) for DNS exfiltration, and Windows Defender's [ConfigSecurityPolicy.exe](https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/) to perform arbitrary GET requests.

For a walkthrough, see the [Black Hills Infosec publication](https://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell/).