linWinPwn - linWinPwn is a bash script that streamlines the us

项目说明

linWinPwn - Swiss-Army knife for Acti Pentesting using Linux

Description

linWinPwn is a bash script that wraps a number of Acti tools for enumeration (LDAP, RPC, ADCS, MSSQL, Kerberos, SCCM), checks (noPac, ZeroLogon, MS17-010, MS14-068), object modifications (password change, add user to group, RBCD, Shadow Credentials) and password dumping (secretsdump, lsassy, nanodump, DonPAPI). The script streamlines the use of a large number of tools: impacket, bloodhound, netexec, enum4linux-ng, ldapdomaindump, lsassy, smbmap, kerbrute, certipy, silenthound, bloodyAD, DonPAPI and many others.

Setup

Git clone the repository and install requirements using the install.sh script

Alternatively, use the pre-built Docker image from Docker Hub

Or build from source

Usage

Mode

The linWinPwn script can be executed in interactive mode (default), or in automated mode (enumeration only).

1. Interactive Mode (Default) - Open interactive menu to run checks separately

2. Automated Mode - Using the --auto parameter, run enumeration tools (no exploitation, modifications or password dumping)

When using the automated mode, different checks are performed based on the authentication method.

Unauthenticated (no credentials provided)

- Anonymous enumeration using netexec, enum4linux-ng, ldapdomaindump, ldeep
- RID bruteforce using netexec
- kerbrute user spray
- Pre2k authentication check on collected list of computers
- ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Blind Kerberoast
- C exploit
- Check for DNS unsecure updates for AS-REQ abuse using krbjack
- SMB shares anonymous enumeration on identified servers
- Enumeration for WebDa, shadowcoerce and Spooler services on identified servers
- Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses

Authenticated (using password, NTLM hash, Kerberos ticket, AES key or pfx Certificate)

- DNS extraction using netexec
- BloodHound data collection
- Enumeration using netexec, enum4linux-ng, ldapdomaindump, bloodyAD, sccmhunter, rdwatool, sccmhunter, GPOParser
- Generate wordlist for password cracking
- netexec find accounts with user=pass
- Pre2k authentication check on domain computers
- Extract ADCS information using certipy and certi.py
- kerbrute find accounts with user=pass
- ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Targeted Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- SMB shares enumeration on all domain servers using smbmap, FindUncommonShares and cme's spider_plus
- Enumeration for WebDa, shadowcoerce and Spooler services on all domain servers (using cme, Coercer and RPC Dump)
- Check for ms17-010, ms14-068, zerologon, petitpotam, nopac, smb-signing, ntlmv1, runasppl, certifried weaknesses, ldapnightmare, badsuccessor
- Check mssql pri escalation paths
- Check mssql relay possibilities

Parameters

Auto config - Run NTP sync with target DC and add entry to /etc/hosts before running the modules

LDAPS - Use LDAPS instead of LDAP (port 636)

Force Kerberos Auth - Force using Kerberos authentication instead of NTLM (when possible)

- Enable all and debug outputs

Interface - Choose attacker's 网络 interface

Targets - Choose targets to be scanned (DC, All, IP=IP_or_hostname, File=./path_to_file)

Custom wordlists - Choose custom user and password wordlists

Tunneling

linWinPwn can be particularly useful when you ha to an Acti en for a limited time only, and you wish to be more efficient in the enumeration process and in the collection of e.
In addition, linWinPwn can replace the use of enumeration tools on Windows in the aim of reducing the number of created artifacts (e.g., PowerShell commands, Windows Events, created files on disk), and bypassing certain Anti-Virus or EDRs. This can be achieved by performing remote dynamic port forwarding through the creation of an SSH tunnel from the Windows host (e.g., or workstation or laptop) to a remote Linux machine (e.g., Pentest laptop or VPS), and running linWinPwn with proxychains.

On the Windows host, run using PowerShell:

On the Linux machine, first update /etc/proxychains4.conf to include socks5 127.0.0.1 1080, then run:

Current supported authentications

| Tool | Null Session | Password | NTLM Hash | Kerberos Ticket| AES Key | Certificate |
|-------------------------|--------------|----------|------------|----------------|-------------|-------------|
| netexec | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Impacket | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ |
| bloodhound-python | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| ldapdomaindump | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| enum4linux-ng | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
| bloodyAD | ❌ | ✅ | ✅ | ✅ | ❌ | ✅ |
| SilentHound | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| ldeep | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
| windapsearch | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| LDAPWordlistHar | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| LDAPConsole | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| pyLDAPmonitor | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| sccmhunter | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| ldapper | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| Adalanche | ❌ | ✅ | ✅ | ✅ | ❌ | ❌ |
| GPOwned | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| ACED | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| breads | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| godap | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
| adcheck | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| certi.py | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Certipy | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ |
| certsync | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| pre2k | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| orpheus | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| smbmap | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| FindUncommonShares | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| smbclient-ng | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| manspider | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| coercer | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| pri | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| RunFinger.py | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ |
| mssqlrelay | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| targetedKerberoast | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| pygpoabuse | ❌ | ✅ | ✅ | ✅ | ❌ | ❌ |
| DonPAPI | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| hekatomb | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| ExtractBitlockerKeys | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| e | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ |
| mssqlpwner | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| SoaPy | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| SCCMSecrets | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| Soaphound | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| gpoParser | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| spearspray | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
| GroupPolicyBackdoor | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
| NetworkHound | ❌ | ✅ | ✅ | ✅ | ❌ | ❌ |
| ShareHound | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| DACLSearch | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| ScriptScout | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
| relayking | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ |
| ADWS Domain Dump | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| PyADRecon | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ |
| PyADRecon-ADWS | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ |
| ADPulse | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ |
| PowerView.py | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| e | ❌ | ✅ | ✅ | ❌ | ❌ | ✅ |
| GhostSPN | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| rbcdbrute | ❌ | ✅ | ✅ | ✅ | ✅ | ❌ |
| xfreerdp | ❌ | ✅ | ✅ | ✅ | ❌ | ❌ |

#### LDAP Channel Binding support
ldap3: netexec, ldapdomaindump (NTLM), Certipy, pre2k, bloodhound, ldeep, GroupPolicyBackdoor, relayking

msldap: bloodyAD

#### LDAP Custom port support
netexec, ldapdomaindump, ldeep, windapsearch, godap, pre2k, ldapnomnom

Demos

HackTheBox Forest

Interactive Mode:
![asciicast]()

Automated Mode:
![asciicast]()

TryHackme Attackti

![asciicast]()

TO DO

Add more enumeration and exploitation tools...

Credits

Inspiration: S3cur3Th1sSh1t - WinPwn

Tools:

- fortra - impacket
- NeffIsBack, Marshall-Hallenbeck, zblurx, mpgn, byt3bl33d3r and all contributors - crackmapexec/netexec
- Fox-IT - bloodhound-python
- dirkjanm - ldapdomaindump, pri
- zer1t0 - certi.py
- ly4k - Certipy
- ShawnDEvans - smbmap
- ropnop - windapsearch, kerbrute
- login-securite - DonPAPI
- Processus-Thief - HEKATOMB
- layer8secure - SilentHound
- ShutdownRepo - TargetedKerberoast
- franc-pentest - ldeep
- garrettfoster13 - pre2k, aced, sccmhunter
- zblurx - certsync
- p0dalirius - Coercer, FindUncommonShares, ExtractBitlockerKeys, LDAPWordlistHar, ldapconsole, pyLDAPmonitor, RDWAtool, smbclient-ng, FindUnusualSessions, ShareHound, GhostSPN
- blacklanternsecurity - MANSPIDER
- Cra - bloodyAD
- shellster - LDAPPER
- TrustedSec - orpheus
- lkarlslund - Adalanche
- X-C3LL - GPOwned
- Hackndo - pyGPOAbuse
- CompassSecurity - mssqlrelay
- lgandx - Responder
- CobblePot59 - ADcheck
- lkarlslund - ldapnomnom
- Macmod - godap
- ScorpionesLabs - MSSqlPwner
- barcrange - C
- logangoins - SoaPy
- synackti, gpoParser, GroupPolicyBackdoor
- j4s0nmo0n - Soaphound
- sikumy - spearspray
- MorDavid - NetworkHound
- cogiceo - DACLSearch
- MarcoZufferli - ScriptScout
- depthsecurity - relayking
- m - ADWS Domain Dump
- l4rm4nd - PyADRecon, PyADRecon-ADWS
- dievus - ADPulse
- aniqfakhrul - PowerView.py
- adityatelange - e
- nnnino - rbcdbrute

References:

-
-
-
-
-
-
-
-
-

For De

Tool Integrator

lwp_tool_integrator.py automates the integration of new tools. It patches linWinPwn.sh, install.sh, and README.md in one step:

Adds 工具 definition and wrapper function

Patches authenticate() with appropriate flags

Adds the tool to the interactive menu

Updates install.sh for automatic installation

Adds reference and auth table row to README.md

Usage:

See lwp_tool_template.json for a configuration example.

Legal Disclaimer

Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. De assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.

项目信息

开发语言：Shell

Star 数：2222

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕linWinPwn is a bash script that streamlines the use of a number of Acti tools展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。