Exploit the credentials present in files and memory
ReflectiveDLLInjection: https://github.com/stephenfewer/ReflectiveDLLInjection
Reflective DLL injection is a library injection technique that is primarily used to perform the loading of a library from memory to host processes. The library should therefore be able to load itself by implementing a minimal PE file loader, managed with minimal interaction between the host system and processes.
A swiss army knife for pentesting Windows/Active Directory environments
nishang: https://github.com/samratashok/nishang
Nishang is a PowerShell-based penetration testing tool. Integration of frameworks, scripts and various payloads. These scripts are written by Nishang’s author in the real penetration testing process, with actual combat value. Including the download and execution, keyboard records, dns, delay commands and other scripts.
UnmanagedPowerShell: https://github.com/leechristensen/UnmanagedPowerShell
Executes PowerShell from an unmanaged process. With a few modifications, these same techniques can be used when injecting into different processes (i.e. you can cause any process to execute PowerShell if you want).
Unicorn: https://github.com/trustedsec/unicorn
Unicorn is a simple tool for PowerShell downgrade attacks and direct injection of shellcode into memory.
PowerShell: https://github.com/clymb3r/PowerShell The tools in this directory are part of PowerSploit and are being maintained there. They are preserved here for legacy, but any bug fixes should be checked in to PowerSploit.
PSRecon: https://github.com/gfoss/PSRecon
PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
PowerTools is a collection of PowerShell projects with a focus on offensive operations.
PowerShellArsenal: https://github.com/mattifestation/PowerShellArsenal
PowerShell module for reverse engineering, can be disassembled hosting and unmanaged code, for. NET malware analysis, analysis of memory, parsing file formats and memory structure, access to internal system information.
PowerShell API Manual: http://www.pinvoke.net/
PInvoke.net is primarily a wiki that allows developers to find, edit, and add PInvoke’s * signatures, user-defined types, and any other information associated with calling managed code for Win32 and other unmanaged APIs.
