diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..94b4ed2 --- /dev/null +++ b/.gitignore @@ -0,0 +1,49 @@ +# Node artifact files +node_modules/ +dist/ + +# Visual studio +*.vs + + +# Compiled Java class files +*.class + +# Compiled Python bytecode +*.py[cod] + +# Log files +*.log + +# Package files +*.jar + +# Maven +target/ +dist/ + +# JetBrains IDE +.idea/ + +# Unit test reports +TEST*.xml + +# Generated by MacOS +.DS_Store + +# Generated by Windows +Thumbs.db + +# Applications +*.app +*.exe +*.war + +# Large media files +*.mp4 +*.tiff +*.avi +*.flv +*.mov +*.wmv + diff --git a/OffensivePipeline/Build.cs b/OffensivePipeline/Build.cs new file mode 100755 index 0000000..4d4c923 --- /dev/null +++ b/OffensivePipeline/Build.cs @@ -0,0 +1,111 @@ +using LibGit2Sharp; +using System; +using System.IO; + +namespace OffensivePipeline +{ + static class Build + { + public static string DownloadRepository(string toolName, string url) + { + string path = "GitTools"; + try + { + if (!Directory.Exists(path)) + { + DirectoryInfo di = Directory.CreateDirectory(path); + } + } + catch (Exception e) + { + Console.WriteLine("The process failed: {0}", e.ToString()); + } + string toolPath = Path.Combine(new string[] { path, toolName }); + if (!Directory.Exists(toolPath)) + { + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" Clonnig the repository: {0}", toolName); + Console.ResetColor(); + Repository.Clone(url, toolPath); + using (var repo = new Repository(toolPath)) + { + var commit = repo.Head.Tip; + Console.WriteLine(@" Last commit: {0}", commit.Author.When.ToLocalTime()); + } + } + return toolPath; + } + public static string BuildTool(string solutionPath, string toolName) + { + string finalPath = string.Empty; + string text = System.IO.File.ReadAllText(Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "template_build.bat" })); + string buildOptions = "/p:Platform=\"Any CPU\""; + solutionPath = Path.Combine(new string[] { Directory.GetCurrentDirectory(), "GitTools", solutionPath }); + string outputDir = Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Output" }); + if (File.Exists(solutionPath)) + { + + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" Solving dependences with nuget..."); + Console.ResetColor(); + if (Helpers.ExecuteCommand(@"Resources\nuget.exe restore " + solutionPath) != 0) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine("Error -> nuget.exe: {0}", solutionPath); + Console.ResetColor(); + } + finalPath = Path.Combine(new string[] { outputDir, toolName + "_" + Helpers.GetRandomString() }); + text = text.Replace("{{SOLUTION_PATH}}", solutionPath); + text = text.Replace("{{BUILD_OPTIONS}}", buildOptions); + text = text.Replace("{{OUTPUT_DIR}}", finalPath); + string batPath = Path.Combine(new string[] { Path.GetDirectoryName(solutionPath), "buildSolution.bat" }); + File.WriteAllText(batPath, text); + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" Building solution..."); + Console.ResetColor(); + if (Helpers.ExecuteCommand(batPath) != 0) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine(" Error -> msbuild.exe: {0}", solutionPath); + Console.ResetColor(); + } else + { + Console.ForegroundColor = ConsoleColor.Green; + Console.WriteLine(" No errors!"); + Console.ResetColor(); + } + } + return finalPath; + } + + public static void Confuse(string folder) + { + string[] exeList = Directory.GetFiles(folder, "*.exe"); + foreach (string exe in exeList) + { + string text = File.ReadAllText(Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "template_confuserEx.crproj" })); + text = text.Replace("{{BASE_DIR}}", folder); + text = text.Replace("{{OUTPUT_DIR}}", Path.Combine(new string[] { folder, "Confused" })); + text = text.Replace("{{EXE_FILE}}", exe); + string crprojPath = Path.Combine(new string[] { folder, exe + ".crproj" }); + System.IO.File.WriteAllText(crprojPath, text); + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" Confusing " + exe + "..."); + Console.ResetColor(); + if (Helpers.ExecuteCommand( + Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx", "Confuser.CLI.exe" }) + " " + crprojPath) != 0) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine(" Error -> ConfuserEx: {0}", exe); + Console.ResetColor(); + } + else + { + Console.ForegroundColor = ConsoleColor.Green; + Console.WriteLine(" No errors!"); + Console.ResetColor(); + } + } + } + } +} diff --git a/OffensivePipeline/GitPoc.csproj b/OffensivePipeline/GitPoc.csproj new file mode 100755 index 0000000..0f14913 --- /dev/null +++ b/OffensivePipeline/GitPoc.csproj @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/OffensivePipeline/Helpers.cs b/OffensivePipeline/Helpers.cs new file mode 100755 index 0000000..c2b1728 --- /dev/null +++ b/OffensivePipeline/Helpers.cs @@ -0,0 +1,115 @@ +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.IO; +using System.IO.Compression; +using System.Net; +using System.Security.Cryptography; + +namespace OffensivePipeline +{ + static class Helpers + { + public static int ExecuteCommand(string command) + { + int exitCode = 0; + try + { + ProcessStartInfo processInfo; + Process process; + processInfo = new ProcessStartInfo("cmd.exe", "/c " + command); + processInfo.CreateNoWindow = true; + processInfo.UseShellExecute = false; + processInfo.RedirectStandardError = true; + processInfo.RedirectStandardOutput = true; + process = Process.Start(processInfo); + //process.WaitForExit(); + string output = process.StandardOutput.ReadToEnd(); + string error = process.StandardError.ReadToEnd(); + exitCode = process.ExitCode; + //Console.WriteLine("output>>" + (String.IsNullOrEmpty(output) ? "(none)" : output)); + //Console.WriteLine("error>>" + (String.IsNullOrEmpty(error) ? "(none)" : error)); + //Console.WriteLine("ExitCode: " + exitCode.ToString(), "ExecuteCommand"); + process.Close(); + } catch (Exception ex) + { + Console.WriteLine("Error executing command <" + command + "> - " + ex.ToString()); + return 1; + } + + return exitCode; + } + + public static string GetRandomString() + { + string path = Path.GetRandomFileName(); + path = path.Replace(".", ""); // Remove period. + return path; + } + + public static int DownloadResources(string url, string outputName, string outputPath) + { + WebClient client = new WebClient(); + try + { + + client.DownloadFile(url, Path.Combine(new string[] { Directory.GetCurrentDirectory(), outputPath, outputName })); + } + catch (Exception ex) + { + Console.WriteLine("Error downloading <" + url + "> - " + ex.ToString()); + return 1; + } + return 0; + } + + public static int UnzipFile(string filePath, string outputFolder) + { + try + { + ZipFile.ExtractToDirectory(filePath, outputFolder); + + } + catch (Exception ex) + { + Console.WriteLine("Error unzipping <" + filePath + "> - " + ex.ToString()); + return 1; + } + return 0; + } + + + static string CalculateMD5(string filename) + { + using (var md5 = MD5.Create()) + { + using (var stream = File.OpenRead(filename)) + { + var hash = md5.ComputeHash(stream); + return BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant(); + } + } + } + + public static void CalculateMD5Files(string folder) + { + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" Calculating md5..."); + Console.ResetColor(); + string[] fileList = Directory.GetFiles(folder, "*.*", SearchOption.AllDirectories); + List md5List = new List(); + foreach (string filename in fileList) + { + using (var md5 = MD5.Create()) + { + using (var stream = File.OpenRead(filename)) + { + var hash = md5.ComputeHash(stream); + md5List.Add(filename + " - " + BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant()); + } + } + } + File.WriteAllLines(Path.Combine(new string[] { folder, "md5.txt" }), md5List); + } + } +} diff --git a/OffensivePipeline/OffensivePipeline.csproj b/OffensivePipeline/OffensivePipeline.csproj new file mode 100755 index 0000000..5f44613 --- /dev/null +++ b/OffensivePipeline/OffensivePipeline.csproj @@ -0,0 +1,106 @@ + + + + Exe + netcoreapp3.1 + Aetsu + https://github.com/aetsu + false + 0.8 + + + + none + false + + + + + + + + + + + + + + + + + + + Always + + + + + + Always + + + + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + Always + + + + diff --git a/OffensivePipeline/OffensivePipeline.csproj.user b/OffensivePipeline/OffensivePipeline.csproj.user new file mode 100755 index 0000000..5d9f69d --- /dev/null +++ b/OffensivePipeline/OffensivePipeline.csproj.user @@ -0,0 +1,6 @@ + + + + <_LastSelectedProfileId>C:\Users\alpha\Desktop\OffensivePipeline\Properties\PublishProfiles\FolderProfile.pubxml + + \ No newline at end of file diff --git a/OffensivePipeline/OffensivePipeline.sln b/OffensivePipeline/OffensivePipeline.sln new file mode 100755 index 0000000..107efd4 --- /dev/null +++ b/OffensivePipeline/OffensivePipeline.sln @@ -0,0 +1,25 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30907.101 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OffensivePipeline", "OffensivePipeline.csproj", "{35E4CDCF-59AD-4946-A9E6-3DDF6661F537}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {35E4CDCF-59AD-4946-A9E6-3DDF6661F537}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {35E4CDCF-59AD-4946-A9E6-3DDF6661F537}.Debug|Any CPU.Build.0 = Debug|Any CPU + {35E4CDCF-59AD-4946-A9E6-3DDF6661F537}.Release|Any CPU.ActiveCfg = Release|Any CPU + {35E4CDCF-59AD-4946-A9E6-3DDF6661F537}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {BAE47189-32EF-4809-A5EB-9271AAB5DF89} + EndGlobalSection +EndGlobal diff --git a/OffensivePipeline/Program.cs b/OffensivePipeline/Program.cs new file mode 100755 index 0000000..00d95da --- /dev/null +++ b/OffensivePipeline/Program.cs @@ -0,0 +1,256 @@ +using Microsoft.Extensions.CommandLineUtils; +using System; +using System.IO; +using YamlDotNet.RepresentationModel; + +namespace OffensivePipeline +{ + class Program + { + static void AnalyzeTools() + { + string[] toolList = Directory.GetFiles("Tools", "*.yml"); + foreach (string tool in toolList) + { + string outputFolder = string.Empty; + string toolPath = string.Empty; + string text = File.ReadAllText(tool); + var stringReader = new StringReader(text); + var yaml = new YamlStream(); + yaml.Load(stringReader); + var mapping = (YamlMappingNode)yaml.Documents[0].RootNode; + + foreach (var entry in mapping.Children) + { + var items = (YamlSequenceNode)mapping.Children[new YamlScalarNode("tool")]; + foreach (YamlMappingNode item in items) + { + Console.ForegroundColor = ConsoleColor.Cyan; + Console.WriteLine("\n[+] Name: {0}", item.Children[new YamlScalarNode("name")]); + Console.ResetColor(); + Console.WriteLine(" - Description: {0}\n - Git link: {1}\n - Solution file: {2}\n", + item.Children[new YamlScalarNode("description")], + item.Children[new YamlScalarNode("gitLink")], + item.Children[new YamlScalarNode("solutionPath")]); + + try + { + toolPath = Build.DownloadRepository(item.Children[new YamlScalarNode("name")].ToString() + , item.Children[new YamlScalarNode("gitLink")].ToString()); + outputFolder = Build.BuildTool( + item.Children[new YamlScalarNode("solutionPath")].ToString(), + item.Children[new YamlScalarNode("name")].ToString()); + if (Helpers.ExecuteCommand("RMDIR \"" + toolPath + "\" /S /Q") != 0) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine("Error -> RMDIR: {0}", toolPath); + Console.ResetColor(); + } + Build.Confuse(outputFolder); + Helpers.CalculateMD5Files(outputFolder); + Console.ForegroundColor = ConsoleColor.Magenta; + Console.WriteLine(" Output folder: {0}", outputFolder); + Console.ResetColor(); + } + catch (Exception ex) + { + Console.WriteLine("Error analyzing: <{0}> -> {1}", item.Children[new YamlScalarNode("name")], ex.ToString()); + } + } + } + } + } + + static void AnalyzeTools(string toolName) + { + string outputFolder = string.Empty; + string toolPath = string.Empty; + if (!File.Exists(@"Tools\" + toolName + ".yml")) + { + Console.ForegroundColor = ConsoleColor.Red; + Console.WriteLine("- Error: {0} tool not supported", toolName); + Console.ResetColor(); + return; + } + string text = File.ReadAllText(@"Tools\" + toolName + ".yml"); + var stringReader = new StringReader(text); + var yaml = new YamlStream(); + yaml.Load(stringReader); + var mapping = (YamlMappingNode)yaml.Documents[0].RootNode; + + foreach (var entry in mapping.Children) + { + var items = (YamlSequenceNode)mapping.Children[new YamlScalarNode("tool")]; + foreach (YamlMappingNode item in items) + { + Console.ForegroundColor = ConsoleColor.Cyan; + Console.WriteLine("\n[+] Name: {0}", item.Children[new YamlScalarNode("name")]); + Console.ResetColor(); + Console.WriteLine(" - Description: {0}\n - Git link: {1}\n - Solution file: {2}\n", + item.Children[new YamlScalarNode("description")], + item.Children[new YamlScalarNode("gitLink")], + item.Children[new YamlScalarNode("solutionPath")]); + + toolPath = Build.DownloadRepository(item.Children[new YamlScalarNode("name")].ToString() + , item.Children[new YamlScalarNode("gitLink")].ToString()); + outputFolder = Build.BuildTool( + item.Children[new YamlScalarNode("solutionPath")].ToString(), + item.Children[new YamlScalarNode("name")].ToString()); + //if (Helpers.ExecuteCommand("RMDIR \"" + toolPath + "\" /S /Q") != 0) + //{ + // Console.ForegroundColor = ConsoleColor.Red; + // Console.WriteLine("Error -> RMDIR: {0}", toolPath); + // Console.ResetColor(); + //} + Build.Confuse(outputFolder); + Helpers.CalculateMD5Files(outputFolder); + Console.ForegroundColor = ConsoleColor.Magenta; + Console.WriteLine(" Output folder: {0}", outputFolder); + Console.ResetColor(); + } + } + + } + static void CheckStart() + { + int error = 0; + if (!File.Exists(Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "nuget.exe" }))) + { + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" [*] Downloading nuget.exe..."); + Console.ResetColor(); + //Download nuget.exe + error = Helpers.DownloadResources(@"https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", "nuget.exe", "Resources"); + if (error != 0) + { + System.Environment.Exit(1); + } + } + if (!Directory.Exists(Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx" }))) + { + Console.ForegroundColor = ConsoleColor.Yellow; + Console.WriteLine(" [*] Downloading ConfuserEx..."); + Console.ResetColor(); + //Download ConfuserEx + error = Helpers.DownloadResources(@"https://github.com/mkaring/ConfuserEx/releases/download/v1.4.1/ConfuserEx-CLI.zip", "ConfuserEx.zip", "Resources"); + if (error != 0) + { + System.Environment.Exit(1); + } + error = Helpers.UnzipFile( + Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx.zip" }), + Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx" })); + if (error != 0) + { + System.Environment.Exit(1); + } + try + { + File.Delete(Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx.zip" })); + } + catch (Exception ex) + { + Console.WriteLine("Error deleting <" + Path.Combine(new string[] { Directory.GetCurrentDirectory(), "Resources", "ConfuserEx.zip" }) + "> - " + ex.ToString()); + } + } + } + + static void ListTools() + { + string[] toolList = Directory.GetFiles("Tools", "*.yml"); + foreach (string tool in toolList) + { + string text = File.ReadAllText(tool); + var stringReader = new StringReader(text); + var yaml = new YamlStream(); + yaml.Load(stringReader); + var mapping = (YamlMappingNode)yaml.Documents[0].RootNode; + foreach (var entry in mapping.Children) + { + var items = (YamlSequenceNode)mapping.Children[new YamlScalarNode("tool")]; + foreach (YamlMappingNode item in items) + { + Console.ForegroundColor = ConsoleColor.Cyan; + Console.WriteLine("\n [+] Name: {0}", item.Children[new YamlScalarNode("name")]); + Console.ResetColor(); + Console.WriteLine(" - Description: {0}\n - Git: {1}", + item.Children[new YamlScalarNode("description")], + item.Children[new YamlScalarNode("gitLink")]); + } + } + } + Console.WriteLine(); + } + + static void Main(string[] args) + { + string banner = @" + ooo + .osooooM M + ___ __ __ _ ____ _ _ _ +y. M M + / _ \ / _|/ _| ___ _ __ ___(_)_ _____| _ \(_)_ __ ___| (_)_ __ ___ :h .yoooMoM + | | | | |_| |_ / _ \ '_ \/ __| \ \ / / _ \ |_) | | '_ \ / _ \ | | '_ \ / _ \ oo oo + | |_| | _| _| __/ | | \__ \ |\ V / __/ __/| | |_) | __/ | | | | | __/ oo oo + \___/|_| |_| \___|_| |_|___/_| \_/ \___|_| |_| .__/ \___|_|_|_| |_|\___| oo oo + |_| MoMoooy. h: + M M .y+ + M Mooooso. + ooo + + @aetsu + "; + Console.WriteLine(banner); + + var app = new CommandLineApplication(); + app.Name = "OffensivePipeline"; + app.HelpOption("-?|-h|--help"); + + app.OnExecute(() => + { + app.ShowHelp(); + return 0; + }); + + app.Command("list", (command) => + { + command.Description = "List all supported tools"; + command.HelpOption("-?|-h|--help"); + command.OnExecute(() => + { + ListTools(); + return 0; + }); + }); + + app.Command("all", (command) => + { + command.Description = "Build and obfuscate all tools"; + command.HelpOption("-?|-h|--help"); + command.OnExecute(() => + { + CheckStart(); + AnalyzeTools(); + return 0; + }); + }); + + app.Command("t", (command) => + { + command.Description = "Build and obfuscate the specified tool"; + command.HelpOption("-?|-h|--help"); + var toolArgument = command.Argument("[tool]", "Tool to build."); + command.OnExecute(() => + { + if (toolArgument.Value != null) + { + CheckStart(); + AnalyzeTools(toolArgument.Value); + } + + return 0; + }); + }); + app.Execute(args); + } + } +} diff --git a/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml b/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml new file mode 100755 index 0000000..fcf13ea --- /dev/null +++ b/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml @@ -0,0 +1,18 @@ + + + + + Release + Any CPU + bin\Release\netcoreapp3.1\publish\ + FileSystem + netcoreapp3.1 + win-x64 + true + False + False + True + + \ No newline at end of file diff --git a/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml.user b/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml.user new file mode 100755 index 0000000..1a189e4 --- /dev/null +++ b/OffensivePipeline/Properties/PublishProfiles/FolderProfile.pubxml.user @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/OffensivePipeline/Resources/template_build.bat b/OffensivePipeline/Resources/template_build.bat new file mode 100755 index 0000000..24ea93e --- /dev/null +++ b/OffensivePipeline/Resources/template_build.bat @@ -0,0 +1,2 @@ +call "C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\Common7\Tools\VsDevCmd.bat" +msbuild.exe "{{SOLUTION_PATH}}" {{BUILD_OPTIONS}} /p:OutputPath="{{OUTPUT_DIR}}" /p:DebugSymbols=false /p:DebugType=None \ No newline at end of file diff --git a/OffensivePipeline/Resources/template_confuserEx.crproj b/OffensivePipeline/Resources/template_confuserEx.crproj new file mode 100755 index 0000000..925c029 --- /dev/null +++ b/OffensivePipeline/Resources/template_confuserEx.crproj @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/OffensivePipeline/Tools/Internal-Monologue.yml b/OffensivePipeline/Tools/Internal-Monologue.yml new file mode 100755 index 0000000..9689394 --- /dev/null +++ b/OffensivePipeline/Tools/Internal-Monologue.yml @@ -0,0 +1,5 @@ +tool: + - name: Internal-Monologue + description: Retrieving NTLM Hashes without Touching LSASS + gitLink: https://github.com/eladshamir/Internal-Monologue + solutionPath: Internal-Monologue\InternalMonologue.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/InveighZero.yml b/OffensivePipeline/Tools/InveighZero.yml new file mode 100755 index 0000000..e269915 --- /dev/null +++ b/OffensivePipeline/Tools/InveighZero.yml @@ -0,0 +1,5 @@ +tool: + - name: InveighZero + description: InveighZero is a C# LLMNR/NBNS/mDNS/DNS/DHCPv6 spoofer and man-in-the-middle tool + gitLink: https://github.com/Kevin-Robertson/InveighZero + solutionPath: InveighZero\Inveigh.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/Rubeus.yml b/OffensivePipeline/Tools/Rubeus.yml new file mode 100755 index 0000000..bfed10e --- /dev/null +++ b/OffensivePipeline/Tools/Rubeus.yml @@ -0,0 +1,5 @@ +tool: + - name: Rubeus + description: Rubeus is a C# toolset for raw Kerberos interaction and abuses + gitLink: https://github.com/GhostPack/Rubeus + solutionPath: Rubeus\Rubeus.sln diff --git a/OffensivePipeline/Tools/Seatbelt.yml b/OffensivePipeline/Tools/Seatbelt.yml new file mode 100755 index 0000000..5f843de --- /dev/null +++ b/OffensivePipeline/Tools/Seatbelt.yml @@ -0,0 +1,5 @@ +tool: + - name: Seatbelt + description: Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives. + gitLink: https://github.com/GhostPack/Seatbelt + solutionPath: Seatbelt\Seatbelt.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/Sharp-SMBExec.yml b/OffensivePipeline/Tools/Sharp-SMBExec.yml new file mode 100755 index 0000000..d86cf4e --- /dev/null +++ b/OffensivePipeline/Tools/Sharp-SMBExec.yml @@ -0,0 +1,5 @@ +tool: + - name: Sharp-SMBExec + description: A native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script + gitLink: https://github.com/checkymander/Sharp-SMBExec + solutionPath: Sharp-SMBExec\SharpInvoke-SMBExec.sln diff --git a/OffensivePipeline/Tools/SharpChromium.yml b/OffensivePipeline/Tools/SharpChromium.yml new file mode 100755 index 0000000..c5c3544 --- /dev/null +++ b/OffensivePipeline/Tools/SharpChromium.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpChromium + description: SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract + gitLink: https://github.com/djhohnstein/SharpChromium + solutionPath: SharpChromium\SharpChromium.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpDPAPI.yml b/OffensivePipeline/Tools/SharpDPAPI.yml new file mode 100755 index 0000000..046fcab --- /dev/null +++ b/OffensivePipeline/Tools/SharpDPAPI.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpDPAPI + description: SharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi's Mimikatz project. + gitLink: https://github.com/GhostPack/SharpDPAPI + solutionPath: SharpDPAPI\SharpDPAPI.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpGPOAbuse.yml b/OffensivePipeline/Tools/SharpGPOAbuse.yml new file mode 100755 index 0000000..e2b5c45 --- /dev/null +++ b/OffensivePipeline/Tools/SharpGPOAbuse.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpGPOAbuse + description: SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO. + gitLink: https://github.com/FSecureLABS/SharpGPOAbuse + solutionPath: SharpGPOAbuse\SharpGPOAbuse.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpHound3.yml b/OffensivePipeline/Tools/SharpHound3.yml new file mode 100755 index 0000000..e6b5b26 --- /dev/null +++ b/OffensivePipeline/Tools/SharpHound3.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpHound3 + description: C# Rewrite of the BloodHound Ingestor + gitLink: https://github.com/BloodHoundAD/SharpHound3 + solutionPath: SharpHound3\SharpHound3.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpMove.yml b/OffensivePipeline/Tools/SharpMove.yml new file mode 100755 index 0000000..c1c8602 --- /dev/null +++ b/OffensivePipeline/Tools/SharpMove.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpMove + description: .NET authenticated execution for remote hosts + gitLink: https://github.com/0xthirteen/SharpMove + solutionPath: SharpMove\SharpMove\SharpMove.sln diff --git a/OffensivePipeline/Tools/SharpRDP.yml b/OffensivePipeline/Tools/SharpRDP.yml new file mode 100755 index 0000000..b509020 --- /dev/null +++ b/OffensivePipeline/Tools/SharpRDP.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpRDP + description: Remote Desktop Protocol Console Application for Authenticated Command Execution + gitLink: https://github.com/0xthirteen/SharpRDP + solutionPath: SharpRDP\SharpRDP\SharpRDP.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpSpray.yml b/OffensivePipeline/Tools/SharpSpray.yml new file mode 100755 index 0000000..9fdf978 --- /dev/null +++ b/OffensivePipeline/Tools/SharpSpray.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpSpray + description: SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike. + gitLink: https://github.com/jnqpblc/SharpSpray + solutionPath: SharpSpray\SharpSpray.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpStay.yml b/OffensivePipeline/Tools/SharpStay.yml new file mode 100755 index 0000000..86ee727 --- /dev/null +++ b/OffensivePipeline/Tools/SharpStay.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpStay + description: .NET Persistence + gitLink: https://github.com/0xthirteen/SharpStay + solutionPath: SharpStay\SharpStay\SharpStay.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpUp.yml b/OffensivePipeline/Tools/SharpUp.yml new file mode 100755 index 0000000..20dc07d --- /dev/null +++ b/OffensivePipeline/Tools/SharpUp.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpUp + description: SharpUp is a C# port of various PowerUp functionality + gitLink: https://github.com/GhostPack/SharpUp + solutionPath: SharpUp\SharpUp.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpView.yml b/OffensivePipeline/Tools/SharpView.yml new file mode 100755 index 0000000..e1bb892 --- /dev/null +++ b/OffensivePipeline/Tools/SharpView.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpView + description: .NET port of PowerView + gitLink: https://github.com/tevora-threat/SharpView + solutionPath: SharpView\SharpView.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/SharpWMI.yml b/OffensivePipeline/Tools/SharpWMI.yml new file mode 100755 index 0000000..62c4b7f --- /dev/null +++ b/OffensivePipeline/Tools/SharpWMI.yml @@ -0,0 +1,5 @@ +tool: + - name: SharpWMI + description: SharpWMI is a C# implementation of various WMI functionality. + gitLink: https://github.com/GhostPack/SharpWMI + solutionPath: SharpWMI\SharpWMI.sln diff --git a/OffensivePipeline/Tools/ThreatCheck.yml b/OffensivePipeline/Tools/ThreatCheck.yml new file mode 100755 index 0000000..f5bef1a --- /dev/null +++ b/OffensivePipeline/Tools/ThreatCheck.yml @@ -0,0 +1,5 @@ +tool: + - name: ThreatCheck + description: Modified version of Matterpreter's DefenderCheck + gitLink: https://github.com/rasta-mouse/ThreatCheck + solutionPath: ThreatCheck\ThreatCheck\ThreatCheck.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/Watson.yml b/OffensivePipeline/Tools/Watson.yml new file mode 100755 index 0000000..4ea9ac7 --- /dev/null +++ b/OffensivePipeline/Tools/Watson.yml @@ -0,0 +1,5 @@ +tool: + - name: Watson + description: Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. + gitLink: https://github.com/rasta-mouse/Watson + solutionPath: Watson\Watson.sln \ No newline at end of file diff --git a/OffensivePipeline/Tools/winPEAS.yml b/OffensivePipeline/Tools/winPEAS.yml new file mode 100755 index 0000000..5b2a447 --- /dev/null +++ b/OffensivePipeline/Tools/winPEAS.yml @@ -0,0 +1,5 @@ +tool: + - name: winPEAS + description: Privilege Escalation Awesome Scripts SUITE + gitLink: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite + solutionPath: winPEAS\winPEAS\winPEASexe\winPEAS.sln \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..06d59a4 --- /dev/null +++ b/README.md @@ -0,0 +1,115 @@ +# OffensivePipeline +![](img/2021-02-18-20-54-21.png) + +**OffensivePipeline** allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises. + +OffensivePipeline downloads the tool from the git repository, then compiles it with *msbuild* and finally obfuscates it with [ConfuserEx](https://github.com/mkaring/ConfuserEx/tree/v1.4.1). + + +## Examples +- List all tools: +``` +OffensivePipeline.exe list +``` +- Build all tools: +``` +OffensivePipeline.exe all +``` +- Build a tool +``` +OffensivePipeline.exe t toolName +``` +![](img/2021-02-18-20-58-21.png) + + +## Add new tools +The scripts for downloading the tools are in the **Tools** folder in **yml** format. New tools can be added by creating new *yml* files with the following format: +- *Rubeus.yml* file: +```yml +tool: + - name: Rubeus + description: Rubeus is a C# toolset for raw Kerberos interaction and abuses + gitLink: https://github.com/GhostPack/Rubeus + solutionPath: Rubeus\Rubeus.sln +``` + + +## Requirements for the release version (Visual Studio 2019 is not required) +- Microsoft .NET Framework 3.5 Service Pack 1 (for some tools): https://www.microsoft.com/es-es/download/details.aspx?id=22 +- Build Tools for Visual Studio 2019: https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools&rel=16 + - Install .NET desktop build tools + ![](img/lib01.png) +- Disable the antivirus :D +- Teste on Windows 10 Pro - Version 20H2 - Build 19042.631 + + +## Requirements for build +- Net framework 3.5.1 (for some tools): https://www.microsoft.com/es-es/download/details.aspx?id=22 +- Visual Studio 2019 -> https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community&rel=16 + - Install .NET desktop build tools + + +## Supported tools +- Internal-Monologue: + - Description: Retrieving NTLM Hashes without Touching LSASS + - GitLink: https://github.com/eladshamir/Internal-Monologue +- InveighZero: + - Description: InveighZero is a C# LLMNR/NBNS/mDNS/DNS/DHCPv6 spoofer and man-in-the-middle tool + - GitLink: https://github.com/Kevin-Robertson/InveighZero +- Rubeus: + - Description: Rubeus is a C# toolset for raw Kerberos interaction and abuses + - GitLink: https://github.com/GhostPack/Rubeus +- Seatbelt: + - Description: Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives. + - GitLink: https://github.com/GhostPack/Seatbelt +- SharpChromium: + - Description: SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract + - GitLink: https://github.com/djhohnstein/SharpChromium +- SharpDPAPI: + - Description: SharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi's Mimikatz project. + - GitLink: https://github.com/GhostPack/SharpDPAPI +- SharpGPOAbuse: + - Description: SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO. + - GitLink: https://github.com/FSecureLABS/SharpGPOAbuse +- SharpHound3: + - Description: C# Rewrite of the BloodHound Ingestor + - GitLink: https://github.com/BloodHoundAD/SharpHound3 +- SharpMove: + - Description: .NET authenticated execution for remote hosts + - GitLink: https://github.com/0xthirteen/SharpMove +- SharpRDP: + - Description: Remote Desktop Protocol Console Application for Authenticated Command Execution + - GitLink: https://github.com/0xthirteen/SharpRDP +- Sharp-SMBExec: + - Description: A native C# conversion of Kevin Robertsons Invoke-SMBExec powershell script + - GitLink: https://github.com/checkymander/Sharp-SMBExec +- SharpSpray: + - Description: SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike. + - GitLink: https://github.com/jnqpblc/SharpSpray +- SharpStay: + - Description: .NET Persistence + - GitLink: https://github.com/0xthirteen/SharpStay +- SharpUp: + - Description: SharpUp is a C# port of various PowerUp functionality + - GitLink: https://github.com/GhostPack/SharpUp +- SharpView: + - Description: .NET port of PowerView + - GitLink: https://github.com/tevora-threat/SharpView +- SharpWMI: + - Description: SharpWMI is a C# implementation of various WMI functionality. + - GitLink: https://github.com/GhostPack/SharpWMI +- ThreatCheck: + - Description: Modified version of Matterpreter's DefenderCheck + - GitLink: https://github.com/rasta-mouse/ThreatCheck +- Watson: + - Description: Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. + - GitLink: https://github.com/rasta-mouse/Watson +- winPEAS: + - Description: Privilege Escalation Awesome Scripts SUITE + - GitLink: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite + + +## TODO +- [ ] Some tools have problems when they are obfuscated (ConfuserEx does not find the dependencies). In a future release of OffensivePipeline this will be patched. +- [ ] Add more tools +- [ ] Bugs? diff --git a/img/2021-02-18-20-54-21.png b/img/2021-02-18-20-54-21.png new file mode 100644 index 0000000..9b6df7c Binary files /dev/null and b/img/2021-02-18-20-54-21.png differ diff --git a/img/2021-02-18-20-58-21.png b/img/2021-02-18-20-58-21.png new file mode 100644 index 0000000..332b2ed Binary files /dev/null and b/img/2021-02-18-20-58-21.png differ diff --git a/img/lib01.png b/img/lib01.png new file mode 100644 index 0000000..aab4e39 Binary files /dev/null and b/img/lib01.png differ