Home

Awesome

SharpAllTheThings

The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command. Credit the name to the amazing PayloadAllTheThings github repo (https://github.com/swisskyrepo/PayloadsAllTheThings)

Build locally (Credit to ZephrFish)

You can use ZephrFish script to download the scripts and build locally, this can be done by following these instructions: https://github.com/N7WEra/SharpAllTheThings/blob/master/BuildAllTheThings/README.md

Precompiled binaries

You can find nightly builds of most of the tools in this awsome repo by Flangvik

https://github.com/Flangvik/SharpCollection

Execution

  1. SharpWMI - implementation of various WMI functionality. This includes local/remote WMI queries, remote WMI process creation through win32_process, and remote execution of arbitrary VBS through WMI event subscriptions. Alternate credentials are also supported for remote methods.
  2. SharpGPOAbuse - take advantage of a user's edit rights on a Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

Persistence

  1. SharpPersist - Windows persistence toolkit written in C#.
  2. SharpStay - .NET project for installing Persistence
  3. SharpEventPersist - Persistence by writing/reading shellcode from Event Log.

Privilege Escalation

  1. SharpUp - port of various PowerUp functionality
  2. Seatbelt - project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
  3. Watson - Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
  4. UnquotedPath - Outputs a list of unquoted service paths that aren't in System32/SysWow64 to plant a PE into.
  5. SweetPotato - Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019
  6. AtYourService - Queries all services on a host and filters out services running as LocalSystem, NT Authority\LocalService, and NT Authority\NetworkService

Defense Evasion

  1. SharpCradle - download and execute .NET binaries into memory.
  2. Internal Monologue - Retrieving NTLM Hashes without Touching LSASS
  3. ATPMiniDump - Dumping LSASS memory with MiniDumpWriteDump on PssCaptureSnapShot to evade WinDefender ATP credential-theft.
  4. SharpeningCobaltStrike - in realtime v35/40 dotnet compiler for your linux Cobalt Strike C2. New fresh compiled and obfuscated binary for each use.
  5. BlockEtw - .Net Assembly to block ETW telemetry in current process
  6. SharpEDRChecker - Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and logging tools.
  7. SharpBlock - SharpBlock can be used to load a child process and prevent any DLL from hooking into the child process.

Credential Access

  1. SharpLocker - helps get current user credentials by popping a fake Windows lock screen, all output is sent to Console which works perfect for Cobalt Strike.
  2. SharpDPAPI - port of some DPAPI functionality from @gentilkiwi's Mimikatz project.
  3. SharpDump - port of PowerSploit's Out-Minidump.ps1 functionality.
  4. SharpWeb - Retrieve saved browser credentials from Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge.
  5. SharpCookieMonster - Extracts cookies from Chrome.
  6. SafetyKatz - combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader.
  7. CredSniper - Prompts the current user for their credentials using the CredUIPromptForWindowsCredentials WinAPI function. Supports an argument to provide the message text that will be shown to the user.
  8. Rubeus - toolset for raw Kerberos interaction and abuses.
  9. RdpTheif - Extracting Clear Text Passwords from mstsc.exe using API Hooking.
  10. SharpSecDump - port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py.
  11. SharpWifiGrabber - Sharp Wifi Password Grabber retrieves in clear-text the Wi-Fi Passwords from all WLAN Profiles saved on a workstation using native win32 API.
  12. SharpHandler - tool for stealing/duping handles to LSASS
  13. SharpLAPS - etrieve the LAPS password from the Active Directory for accounts with ExtendedRight or Generic All Rights
  14. BetterSafetyKatz - modified fork of SafetyKatz dynamically fetches the latest pre-compiled release of Mimikatz directly from the gentilkiwi GitHub repo, runtime patching on detected signatures and uses SharpSploit DInvoke to get it into memory.
  15. SharpKatz - Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands
  16. SharpMiniDump - Create a minidump of the LSASS process from memory (Windows 10 - Windows Server 2016). The entire process uses: dynamic API calls, direct syscall and Native API unhooking to evade the AV / EDR detection.

Discovery

  1. SharpHound - Uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment, executes collection options necessary to populate the backend BloodHound database.
  2. SharpWitness - C# version of EyeWitness by Christopher Truncer. Take screenshots of websites, provide some server header info, and identify default credentials if possible.
  3. SharpDomainSpray - very simple password spraying tool written in .NET. It takes a password then finds users in the domain and attempts to authenticate to the domain with that given password.
  4. SharpSniper - Find specific users in active directory via their username and logon IP address
  5. SharpFruit - Port of Find-Fruit.ps1, aid Penetration Testers in finding juicy targets on internal networks without nmap scanning.
  6. SharpPrinter- tool to enumerate all visible network printers in local network
  7. SharpView - C# implementation of harmj0y's PowerView
  8. SharpSearch - Search files for extensions as well as text within.
  9. SharpClipHistory - Read the contents of a user's clipboard history in Windows 10 starting from the 1809 Build.
  10. SharpClipboard - Monitor of the clipboard for any passwords
  11. SharpChromium - .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
  12. ADFSDump - dump all sorts of goodies from AD FS.
  13. SessionSearcher - Searches all connected drives for PuTTY private keys and RDP connection files and parses them for relevant details. Based on SessionGopher by @arvanaghi.
  14. InveighZero - Windows C# LLMNR/mDNS/NBNS/DNS spoofer/man-in-the-middle tool
  15. EyeWitness - take screenshots of websites, provide some server header info, and identify default credentials if possible
  16. Spray-AD - audit Active Directory user accounts for weak, well known or easy guessable passwords.
  17. Recon-AD - an AD recon tool based on ADSI and reflective DLL’s
  18. Grouper2 - A tool for pentesters to help find security-related misconfigurations in Active Directory Group Policy.
  19. SharpMapExec - A sharpen version of CrackMapExec.
  20. SharpSMBSpray - Spray a hash via smb to check for local administrator access.
  21. SauronEye - Search tool find specific files containing specific keywords (.doc, .docx, .xls, .xlsx)
  22. SharpShare - Multithreaded C# .NET Assembly to enumerate accessible network shares in a domain (Updated version)
  23. SharpLDAP - C# .NET Assembly to perform LDAP Queries
  24. ADCollector - a lightweight tool that enumerates the Active Directory environment to identify possible attack vectors.
  1. StandIn - small AD post-compromise toolkit
  1. TruffleSnout - iterative AD discovery toolkit for offensive operators
  1. ThunderFox - Retrieves data (contacts, emails, history, cookies and credentials) from Thunderbird and Firefox
  1. SharpSQL- Quick and dirty .net console app for querying mssql servers.
  1. LdapSignCheck - Beacon Object File to scan a Domain Controller to see if LdapEnforceChannelBinding or LdapServerIntegrity has been modified to mitigate against relaying attacks.

Lateral Movement

  1. SharpCom - port of Invoke-DCOM, Execute's commands via various DCOM methods as demonstrated by (@enigma0x3)
  2. Sharpexcel4_dcom - Port of Invoke-Excel4DCOM, Lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
  3. SharpExec - C# tool designed to aid with lateral movement
  4. SharpRDP - Remote Desktop Protocol .NET Console Application for Authenticated Command Execution
  5. SharpMove - .NET Project for performing Authenticated Remote Execution
  6. SCShell - fileless lateral movement tool that relies on ChangeServiceConfigA to run commands.
  7. SharpSphere - gives red teamers the ability to easily interact with the guest operating systems of virtual machines managed by vCenter.
  8. Sharp-SMBExec - A native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script
  9. SharpNoPSExec- File less command execution for lateral movement.

Exfiltration

  1. SharpBox - Tool for compressing, encrypting, and exfiltrating data to DropBox using the DropBox API.
  2. EncryptedZIP -Compresses a directory or file and then encrypts the ZIP file with a supplied key using AES256 CFB. This assembly also clears the key out of memory using RtlZeroMemory. Use the included Decrypter progam to decrypt the archive.
  3. Zipper - a CobaltStrike file and folder compression utility.

Other projects

  1. OffensiveCSharp - Collection of Offensive C# Tooling
  2. SharpAllowedToAct - implementation of a computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)