Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Changelog
  - [1.1.1] - 2020-11-06
    - Added
    - Fixed
  - [1.1.0] - 2020-09-30
    - Added
    - Changed
    - Fixed
  - [1.0.0] - 2020-05-26
    - Added
    - Changed
    - Fixed
    - Removed
  - [0.2.0] - 2018-08-20
    - Added
    - Changed
  - [0.1.0] - 2018-07-24

# Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

## [1.1.1] - 2020-11-06

### Added

- Added remote support to the following commands:

  - PowerShell, DotNet
  - FirefoxPresence, FirefoxHistory
  - ChromePresence/ChromeHistory/ChromeBookmarks
  - InternetExplorerFavorites, IEUrls
  - SlackDownloads, SlackPresence, SlackWorkspaces
  - CloudCredentials, FileZilla, OutlookDownloads, RDCManFiles
  - SuperPutty, LocalUsers, LocalGroups, PowerShellHistory
  - Credguard, InstalledProducts, AppLocker, AuditPolicyRegistry
  - DNSCache, PSSessionSettings, OSInfo, EnvironmentVariables, DpapiMasterKeys

- Implemented remote event log support:

  - ExplicitLogonEvents, LogonEvents, PoweredOnEvents, PowerShellEvents, ProcessCreationEvents, SysmonEvents

- Chrome* modules now converted to Chromium support:

  - Chrome, Edge, Brave, Opera

- Added IBM Bluemix enumeration to CloudCredentials

### Fixed

- Better error handling in various modules
- OS version number collection on Windows 10
- McAfeeSiteList null pointer exception
- Interpretation of uac/tokenfilter/filteradmintoken values
- Nullable type issues
- WindowsFirewall filtering

## [1.1.0] - 2020-09-30

### Added

- Added the following commands:
  - Hotfixes - installed hotfixes (via WMI)
  - MicrosoftUpdates - all Microsoft updates (via COM)
  - HuntLolbas - hunt for living-off-the-land binaries (from @NotoriousRebel)
  - PowerShellHistory - searches PowerShell console history files for sensitive regex matches (adapted from @NotoriousRebel)
  - RDPSettings - Remote Desktop Server/Client Settings
  - SecPackageCreds - obtains credentials from security packages (InternalMonologue for the current user)
  - FileZilla - files user FileZilla configuration files/passwords
  - SuperPutty - files user SuperPutty configuration files
  - McAfeeSiteList - finds/decrypts McAfee SiteList.xml files
  - McAfeeConfigs- finds McAfee configuration files

### Changed

- Added CLR version enumeration to "DotNet" and "PowerShell" commands
- Updated LSASettings to detect restricted admin mode
- Added ZoneMapKey & Auth settings to "InternetSettings" (Francis Lacoste)
- Added support for ByteArrays in "WindowsVault"
- Redid assembly detection to (hopefully) prevent image load events
- Added version/description fields to processes and services
- Added ASR rules to "WindowsDefender" command

### Fixed

- Big fix for event log searching
- Fix for sensitive command line scraping
- Code cleanup/dead code removal
- Allow empty companyname the Services command
- Better exception handling
- Various fixes/expansions for the "WindowsVault" command
- Added disposing of output sinks
- Other misc. bug fixes

## [1.0.0] - 2020-05-26

### Added

- Added the following commands:
  - NTLMSettings, SCCM, WSUS, UserRightAssignments, IdleTime, FileInfo, NamedPipes, NetworkProfile
  - AMSIProviders, RPCMappedEndpoints, LocalUsers, CredGuard, LocalGPOs, OutlookDownloads
  - AppLocker (thanks @_RastaMouse! https://github.com/GhostPack/Seatbelt/pull/15)
  - InstalledProducts and Printers commands, with DACLs included for printers
  - SearchIndex - module to search the Windows Search Indexer
  - WMIEventFilter/WMIEventConsumer/WMIEventConsumer commands
  - ScheduledTasks command (via WMI for win8+)
  - AuditPolicies/AuditSettings - classic and advanced audit policy settings
  - EnvironmentPath - %ENV:PATH% folder enumeration, along with DACLs
  - ProcessCreation - from @djhohnstein's EventLogParser project. Expanded sensitive regexes.
  - CredEnum - use CredEnumerate() to enumerate the credentials from the user's credential set (thanks @djhohnstein and @peewpw)
  - SecurityPackages - uses EnumerateSecurityPackages() to enumerate available security packages
  - WindowsDefender - exclusions for paths/extensions/processes for Windows Defender
  - DotNet - detects .NET versions and whether AMSI is enabled/can by bypassed (similar to 'PowerShell')
  - ProcessOwners - simplified enumeration of non-session 0 processes/owners that can function remotely
  - dir
    - Allows recursively enumerating directories and searching for files based on a regex
    - Lists user folders by default
    - Usage: "dir [path] [depth] [searchRegex] [ignoreErrors? true/false]"
    - Default: "dir C:\users\ 2 \(Documents|Downloads|Desktop) false"
      - Shows files in users' documents/downloads/desktop folders
  - reg
    - Allows recursively listing and searching for registry values on the current machine and remotely (if remote registry is enabled).
  - Added additional defensive process checks thanks to @swarleysez, @Ne0nd0g, and @leechristensen. See https://github.com/GhostPack/Seatbelt/pull/17 and https://github.com/GhostPack/Seatbelt/pull/19.
  - Added Xen virtual machine detections thanks to @rasta-mouse. See https://github.com/GhostPack/Seatbelt/pull/18
- Added the following command aliases:
  - "Remote" for common commands to run remotely
  - "Slack" to run Slack-specific modules
  - "Chrome" to run Chrome-specific modules
- Added in ability to give commands arguments (to be expanded in the future). Syntax: `Seatbelt.exe "PoweredOnEvents 30"`
- Added remote support for WMI/registry enumeration modules that are marked with a +
  - Usage: computername=COMPUTER.DOMAIN.COM [username=DOMAIN\USER password=PASSWORD]
- Added the "-q" command-line flag to not print the logo
- Added ability to output to a file with the the "-o <file>" parameter
  - Providing a file that ends in .json produces JSON-structured output!
- Added in the architecture for different output sinks. Still need to convert a lot of cmdlets to the new format.
- Added a module template.
- Added CHANGELOG.md.

### Changed

- Externalized all commands into their own class/file
- Cleaned up some of the registry querying code
- Commands can now be case-insensitive
- Seatbelt's help message is now dynamically created
- Renamed RebootSchedule to PoweredOnEvents
  - Now enumerates events for system startup/shutdown, unexpected shutdown, and sleeping/awaking.
- Modified the output of the Logon and ExplicitLogon event commands to be easier to read/analyze
- LogonEvents, ExplicitLogonEvents, and PoweredOnEvents take an argument of how many days back to collect logs for. Example: Seatbelt.exe "LogonEvents 50"
- Added Added timezone, locale information, MachineGuid, Build number and UBR (if present) to OSInfo command
- Refactored registry enumeration code
- Putty command now lists if agent forwarding is enabled
- Renamed BasicOSInfo to OSInfo
- Simplified IsLocalAdmin code
- Added the member type to localgroupmembership output
- Simplified the RDPSavedConnections code
- Formatted the output of RDPSavedConnections to be prettier
- Formatted the output of RecentFiles to be prettier
- Modified logonevents default so that it only outputs the past day on servers
- Re-wrote the PowerShell command. Added AMSI information and hints for bypassing.
- Add NTLM/Kerberos informational alerts to the LogonEvents command
- Changed the output format of DpapiMasterKeys
- Re-wrote the Registry helper code
- Refactored the helper code
- Incorprated @mark-s's code to speed up the interestingfiles command. See #16
- Added SDDL to the "fileinfo" command
- Added MRUs for all office applications to the RecentFiles command
- RecentFiles now has a paramater that restricts how old the documents are. "RecentFiles 20" - Shows files accessed in the last 20 days.
- Renamed RegistryValue command to "reg"
- Search terms in the "reg" command now match keys, value names, and values.
- Updated the "reg" commands arguments.
  - Usage: "reg <HIVE[\PATH\TO\KEY]> [depth] [searchTerm] [ignoreErrors]"
  - Defaults: "reg HKLM\Software 1 default true"
- Added generic GetSecurityInfos command into SecurityUtil
- Formatting tweak for DPAPIMasterkeys
- WindowsVaults output filtering
- Renamed RecentFiles to ExplorerMRUs, broke out functionality for ExplorerMRUs and OfficeMRUs
- Broke IETriage command into IEUrls and IEFavorites
- Changed FirefoxCommand to FirefoxHistory
- Changed ChromePresence and FirefoxPresence to display last modified timestamps for the history/cred/etc. files
- Split ChromeCommand into ChromeHistoryCommand and ChromeBookmarksCommand
- Broke PuttyCommand into PuttyHostKeys and PuttySessions
- Added SDDL field to InterestingFiles command
- Modified IdleTime to display the current user and time in h:m:s:ms format
- Moved Firewall enumeration to the registry (instead of the COM object). Thanks @Max_68!
- Changed TokenGroups output formatting
- Renamed localgroupmemberships to localgroups
- Changed network firewall enumeration to display "non-builtin" rules instead of deny. Added basic filtering.
- Added IsDotNet property to the FileInfo command
- Renamed "NonstandardProcesses" and "NonstandardServices" to "Processes" and "Services", respectively
- LocalGroups now enumerates all (by default non-empty) local groups and memberships, along with comments
- Added a "modules" argument to the "Processes" command to display non-Microsoft loaded processes
- Notify operator when LSA Protected Mode is enabled (RunAsPPL)
- Updated the EnvironmentVariables command to distinguish between user/system/current process/volatile variables
- Added a user filter to ExplicitLogonEvents. Usage: `ExplicitLogonEvents <days> <targetUserRegex>`
- Added version check for Chrome (v80+)
- Added analysis messages for the logonevents command
- Rewrote and expanded README.md

### Fixed

- Some timestamp converting code in the ticket extraction section
- Fixed Chrome bookmark command (threw an exception with folders)
- Fixed reboot schedule (xpath query wasn't precise enough, leading to exceptions)
- Fixed an exception that was being thrown in the CloudCredential command
- NonstandardServices command
  - Fixed a bug that occurred during enumeration
  - Added ServiceDll and User fields
  - Partially fixed path parsing in NonstandardServices with some help from OJ (@TheColonial)! See https://github.com/GhostPack/Seatbelt/pull/14
  - Cleaned up the code
- Fixed a bug in localgroupmembership
- Check if it's a Server before running the AntiVirus check (the WMI class isn't on servers)
- Fixed a bug in WindowsCredentialFiles so it wouldn't output null bytes
- Fixed a null reference bug in the PowerShell command
- Fixed the OS version comparisons in WindowsVault command
- Fixed a DWORD parsing bug in the registry util class for big (i.e. negative int) values
- ARPTable bug fix/error handling
- Fixed PuttySession HKCU v. HKU bug
- Fixed a terminating exception bug in the Processes command when obtaining file version info
- More additional bug fixes than we can count >_<

### Removed

- Removed the UserFolder command (replaced by DirectoryList command)

## [0.2.0] - 2018-08-20

### Added

- @djhohnstein's vault enumeration

### Changed

- @ClementNotin/@cnotin's various fixes

## [0.1.0] - 2018-07-24

- Initial release