9fefd167b0
Just fyi for anyone reading this, it's not even close to being finished. The amount of changes are pretty insane, this commit is to serve as a refrence point for myself. Highlights for v4.0: - The whole codebase has been re-written from scratch - Codebase has been cut around 2/4 - Protocols are now modular! In theory we could use CME for everything - Module chaining has been removed for now, still trying to figure out a more elegant solution - Workspaces have implemented in cmedb - The smb protocol's database schema has been changed to support storing users, groups and computers with their respective memberships and relations. - I'm in the process of re-writing most of the modules, will re-add them once i've finished |
||
|---|---|---|
| .github | ||
| cme | ||
| .gitignore | ||
| .gitmodules | ||
| LICENSE | ||
| MANIFEST.in | ||
| Makefile | ||
| README.md | ||
| requirements.txt | ||
| setup.cfg | ||
| setup.py | ||
README.md
CrackMapExec
A swiss army knife for pentesting Windows/Active Directory environments
Powered by Impacket
This project was inspired by/based off of:
- @agsolino's wmiexec.py, wmiquery.py, smbexec.py, samrdump.py, secretsdump.py, atexec.py and lookupsid.py scripts (beyond awesome)
- @ShawnDEvans's smbmap
- @gojhonny's CredCrack
- @pentestgeek's smbexec
Unintentional contributors:
This repo also includes the PowerSploit repository as a submodule.
#Documentation, Tutorials, Examples See the project's wiki for documentation and usage examples
#Description
CrackMapExec is your one-stop-shop for pentesting Windows/Active Directory environments!
From enumerating logged on users and spidering SMB shares to executing psexec style attacks, auto-injecting Mimikatz/Shellcode/DLL's into memory using Powershell, dumping the NTDS.dit and more!
The biggest improvements over the above tools are:
- Pure Python script, no external tools required
- Fully concurrent threading
- Uses ONLY native WinAPI calls for discovering sessions, users, dumping SAM hashes etc...
- Opsec safe (no binaries are uploaded to dump clear-text credentials, inject shellcode etc...)
Additionally, a database is used to store used/dumped credentals. It also automatically correlates Admin credentials to hosts and vice-versa allowing you to easily keep track of credential sets and gain additional situational awareness in large environments.
#Installation
Use virtualenvwrapper to install CrackMapExec in a python virtualenv
To get the latest stable version:
#~ pip install crackmapexec
If you like living on the bleeding-edge:
#~ git clone https://github.com/byt3bl33d3r/CrackMapExec
#- cd CrackMapExec && git submodule init && git submodule update --recursive
#~ python setup.py install
Note for Kali/Debian/Ubuntu Users:
If you get compilation errors run apt-get install -y libssl-dev libffi-dev python-dev build-essential and try again.
#To do
- Kerberos support
0wn everything