Peneter Tools

Let's start 2026 with a major Responder update! It now supports: - CLDAP ping pong to SMB auth. - SNMPv3 authentication and hashes. - New rogue Kerberos server forcing AS-REQ when receiving TGS-REQ + support for Kerberos type 17/18 hashes. - IMAP support for NTLM authentication. - SMTP support for AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 NTLM authentication. - DCE-RPC server now supports SAMR, SRVSVC, WKSSVC, WINREG, SVCCTL, ATSVC, DNSSERVER - DNS server now supports SOA, MX, SRV, ANY, etc -> SOA -> Appear as the authoritative DNS server -> MX poisoning → Email client connects to rogue SMTP/IMAP → capture credentials -> SRV poisoning → Domain services connect to rogue SMB/LDAP/Kerberos → capture NTLM/AS-REQ - LDAP GSSAPI, GSS-SPNEGO, NTLM, DIGEST-MD5 https://github.com/lgandx/Responder

https://github.com/lgandx/PCredz/

https://react2shell.com/ https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3 https://gist.github.com/joe-desimone/ff0cae0aa0d20965d502e7a97cbde3e3

https://github.com/The-Viper-One/Invoke-PowerChrome

https://github.com/kfallahi/UnderlayCopy

https://github.com/kfallahi/NTLMPasswordChanger/

https://github.com/5w0rdfi5h/Torpedo

https://github.com/M1ndo/WerDump

EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state. https://github.com/TwoSevenOneT/EDR-Freeze

https://github.com/isclayton/viewstalker

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130) https://github.com/BitsByWill/ksmbd-n-day

https://github.com/Mr-Un1k0d3r/DotnetNoVirtualProtectShellcodeLoader

Comprehensive Windows Syscall Extraction & Analysis Framework https://github.com/xaitax/NTSleuth

Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis (such as Code Integrity Policy files). https://github.com/rasta-mouse/pwnlift

Group Policy Objects manipulation and exploitation framework https://github.com/synacktiv/GroupPolicyBackdoor

you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll! https://github.com/whokilleddb/function-collections/blob/main/winapi_alternatives/NtAllocateMemoryEx/main.c https://github.com/whokilleddb/hoontr

Weaponize DLL hijacking easily. Backdoor any function in any DLL https://github.com/Print3M/DllShimmer

Your template-based BloodHound terminal companion tool https://github.com/fin3ss3g0d/cypherhound

TAP SSH VPN - this will allow you to VPN your machine into the remote TAP device through a reverse SSH tunnel. https://github.com/trustedsec/tap/blob/master/scripts/ssh-tunnel.sh

PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph https://github.com/SpecterOps/MSSQLHound