Evil Winrm

Evil-WinRM is a penetration testing tool and interactive remote shell designed for managing and executing commands on remote Windows systems via the WinRM protocol. It functions as a security utility for auditing Windows environments through remote command execution and credential manipulation.

The tool distinguishes itself through its authentication capabilities, acting as both a Kerberos authentication client using ticket-based files and an NTLM pass-the-hash client that accesses services using password hashes instead of plaintext credentials. To evade detection, it supports in-memory payload execution, allowing scripts and libraries to run directly in system memory without writing files to disk.

The project provides broader capabilities for lateral movement and security assessment, including the ability to bypass security defenses, enumerate remote services, and transfer files between local and remote hosts. It also includes session management features such as local activity logging and command history tracking.

Features

Penetration Testing Tools - Provides a specialized security utility for auditing Windows environments through remote command execution and credential manipulation.
Interactive Remote Shells - Establishes an interactive remote shell over WinRM to execute commands on target Windows systems.
Windows Remote Management Tools - Provides a specialized tool for managing and executing commands on remote Windows systems via the WinRM protocol.
In-Memory Payload Execution - Implements techniques to execute PowerShell scripts directly in volatile memory to evade disk-based security detection.
Kerberos Authentication - Implements Kerberos authentication to verify identity to network services using ticket-based files.
Ticket-Based Authenticators - Supports authentication using Kerberos ticket-granting files and realm configurations to access remote resources without passwords.
Pass-the-Hash Clients - Enables access to remote systems by providing captured NTLM password hashes directly to the service.
Interactive Remote Shells - Provides a bidirectional terminal session for real-time interaction and command execution on remote Windows systems.
Penetration Testing - Provides a toolset for performing security assessments on Windows targets via remote command execution.
Service Enumeration Tools - Lists available services on a target machine to identify manageable resources based on user permissions.
Security Software Evasion - Disables script protection and event tracing to evade detection by security software.
Lateral Movement Techniques - Facilitates movement through target environments using NTLM hashes and Kerberos tickets.
Remote File Transfers - Provides bidirectional file transfers between local and remote systems with progress monitoring.
Lateral Movement - Provides shell access via WinRM.
Windows Post Exploitation - Command line interface for remote management and command execution on Windows.

samratashok/nishang

9,951View on GitHub

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

TheWover/donut

4,461View on GitHub

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

mantvydasb/RedTeaming-Tactics-and-Techniques

4,620View on GitHub

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

trickster0/OffensiveRust

2,984View on GitHub

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

Hackplayersevil-winrm

Features