PwnRM - PwnRM是一个操作员级别的Active Directory post-e

项目说明

<di="center">

!PwnRM ASCII

Ad WinRM Post-Exploitation Platform for Windows Acti Testing

!GitHub stars
!GitHub forks
!GitHub issues
!License
!PyPI
!Platform

An operator-grade WinRM execution and red team platform for authorized Acti security assessments (2026–2027 TTPs): in-memory , coerced authentication suite, Windows LAPS & Server 2025 hunting, AD DACL pri escalation scout, token impersonation, multi-session graph orchestration, in-band SOCKS5 multiplexing, full ADCS ESC1-ESC17+ (incl. WSUS abuse), Diamond Ticket suite, hybrid Entra ID pi, polymorphic e runtime, in-memory BloodHound collection, and structured loot pipeline - usable as a CLI tool and as a Python library.

Installation · Usage · Commands · Niche Modules · AD Triage · Documentation · Share Scout · Session Scout · Changelog · Library Usage · Troubleshooting · Disclaimer · Hall Of Fame

</div>

---

<a id="installation"></a>

📦 Installation

pip (recommended)

git clone + installer (Kali / Ubuntu / Debian)

The installer creates a at /opt/pwnrm and registers a global pwnrm wrapper.

Manual / De Setup

---

<a id="usage"></a>

Connection & Authentication Usage

Key Flags: --port, --ssl, --timeout, --ts, --debug, --replay, -X. Run pwnrm -h for the full list.

---

<a id="commands"></a>

Complete Interacti Commands

PwnRM v2.1 provides 13 specialized built-in modules alongside core platform commands:

| Category | Command | Description |
| :--- | :--- | :--- |
| Core Platform | !session [list, switch, sa] | Multi-session manager & jump graph orchestrator |
| | !socks [PORT, stop, status] | In-band SOCKS5 proxy multiplexer (default: 1080) |
| | !portfwd [LPORT RHOST:RPORT, list, stop] | Local & remote port forwarding multiplexer |
| | !module [list, run <name>] | Extensible plugin subsystem & module runner |
| | !loot | Structured credential & artifact in |
| | !opsec [stealth, balanced, aggressi] | Dynamic execution jitter & OPSEC profile switcher |
| | !playbook [--list, --run <name>] | Declarative red team playbook runner |
| Identity & AD Abuse | !adcs [-q, --template <T>, --wsus] | Full ADCS ESC1-ESC17+ engine & certificate/WSUS triage |
| | !kerberos [--roast, --asrep, --dmsa, --diamond] | Ad Kerberos suite (AES roasting, dMSA/BadSuccessor) |
| | !entra [-s] | Hybrid Entra ID / Azure AD PRT pivot & join state recon |
| | !creds [--vault, --dpapi, --history] | Deep credential & token artifact hunter |
| | !laps [-a, --encrypted] | Windows LAPS hunter (Legacy ms-Mcs-AdmPwd & Server 2025 msLAPS) |
| | !acl [--target <T>, --tier0] | Acti DACL & Tier-0 pri escalation scout |
| | !token [--list, --pri] | Process token hunter & in-memory impersonation suite |
| | !bloodhound [-c <methods>] | In-memory Acti graph collector (BloodHound CE) |
| | !lateral [--subnet <s>] | Subnet scout & lateral mo engine |
| In-Memory & Staging | !vss [--drive C:, --sam, --ntds, --clean] | In-memory copy hi (SAM/SYSTEM/NTDS) |
| | !coerce --listener <IP> [--method M] | Coerced authentication engine (WebDA, MS-EFSR, DFS) |
| | !e [--edr, --amsi, --etw] | Polymorphic AMSI/ETW memory patching & EDR scout |
| | !download RPATH [LPATH] | Pull file/dir from target (dirs auto-zipped) |
| | !upload [-xor] LPATH [RPATH] | Push file; -xor for encrypted staging |
| | !amsi | Patch AmsiScanBuffer in the remote process (polymorphic) |
| | !psrun [-xor] URL | Execute remote PowerShell ScriptBlock |
| | !netrun [-xor] URL [ARG..] | Load & invoke remote .NET assembly in-memory |
| | !re IP PORT | Raw Winsock reverse shell (full I/O, no cmd logging) |
| Triage & Snapshot | !adtriage [-q] | Built-in Acti enumeration engine |
| | !shares [-q] [HOST ..] | SMB share scout - UNC access, ACLs, SYSVOL GPP cPassword |
| | !sessions [-q] | Session & network snapshot - logon sessions, tickets, TCP |
| | !sysinfo | OS / A / local-admin snapshot |
| | !log / !stoplog | Toggle session transcript |
| | exit / quit / Ctrl+D | Close session (Ctrl+C interrupts running commands) |

---

<a id="niche-modules"></a>

Niche Operator Modules & TTPs [v2.1.0]

1. In-Memory Copy Hi (!vss)

Extracts locked credentials databases (SAM, SYSTEM, SECURITY, and NTDS.dit) directly via WMI / CIM COM reflection ([wmiclass]"Win32_ShadowCopy").

Anti-EDR Design: Does not invoke .exe or ntdsutil.exe (which immediately trigger EDR process-creation alerts).

Forensic Hygiene: Instantly calls .Delete() on the created shadow copy upon extraction, leaving zero residual shadow copies on disk.

Commands:

2. Coerced Authentication Engine (!coerce)

Triggers outbound authentication from the target machine account or server to an operator listener (Responder / ntlmrelayx), supporting 4 distinct coercion methods:
1. WebDAV HTTP UNC Paths: \\listener@80\share\dummy.txt forces the WebClient service to authenticate over HTTP instead of SMB — bypassing SMB signing and enabling direct relaying to ADCS ESC8 Web Enrollment.
2. MS-RPRN Print Spooler: In-memory RPC trigger targeting \pipe\spoolss.
3. MS-EFSR PetitPotam: In-memory RPC trigger targeting \pipe\efsrpc and \pipe\lsarpc.
4. MS-DFSNM: In-memory RPC trigger targeting \pipe\netdfs.

Commands:

3. Windows LAPS & Server 2025 Password Hunter (!laps)

Performs 100% in-memory LDAP directory queries for local administrator passwords managed by Windows LAPS:

Legacy LAPS: ms-Mcs-AdmPwd (cleartext password) and ms-Mcs-AdmPwdExpirationTime.

Modern Server 2025 / Windows 11 LAPS: msLAPS-Password (cleartext), msLAPS-EncryptedPassword, msLAPS-EncryptedDSRMPassword, and msLAPS-PasswordHistory.

Commands:

4. Acti DACL & Pri Escalation Scout (!acl)

Audits Discretionary Access Control Lists (DACLs) on Tier-0 and high-value objects (AdminSDHolder, Domain Admins, Domain Controllers, krbtgt, GPOs).

Flags exploitable rights: GenericAll, WriteDacl (modify ACL to gain full control), WriteOwner (take ownership), GenericWrite, and User-Force-Change-Password (Extended Right GUID 00299570-246d-11d0-a768-00aa006e0529).

Commands:

5. Process Token Hunter & In-Memory Impersonation (!token)

Inspects token pri and accessible process tokens across active user sessions.

E high-impact rights: SeImpersonatePri, SeAssignPrimaryTokenPri, SeDebugPri, SeBackupPri, SeRestorePri, SeTcbPri.

Discovers SYSTEM and Administrator processes suitable for token duplication or named pipe impersonation without dropping binaries to disk.

Commands:

---

<a id="ad-triage"></a>

Identity, ADCS & Kerberos Exploitation

Full ADCS Engine (!adcs)

Comprehensi Directory Certificate Services audit co ESC1 through ESC17+:

ESC1 / ESC2: Enrollee supplies SAN (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x1) with Client Authentication / Any Purpose EKUs.

ESC3 / ESC4: Certificate Request Agent (1.3.6.1.4.1.311.20.2.1) and template ACLs.

ESC6 / ESC7: CA EDITF_ATTRIBUTESUBJECTALTNAME2 registry flag & CA permissions.

ESC17 (WSUS & Code Signing Policy Abuse): Detects Code Signing (1.3.6.1.5.5.7.3.3) and Windows Update templates combined with WSUS client registry policy AcceptTrustedPublisherCerts = 1 and cleartext HTTP WUServer endpoints.

Ad Kerberos Suite (!kerberos)

AES Kerberoasting: Requests TGS tickets with AES256-CTS-HMAC-SHA1-96 priority (for modern RC4-deprecated AD).

AS-REP Roasting: Queries accounts with DONT_REQ_PREAUTH (0x400000).

Diamond Ticket Workflow: Assists in identity-swap TGT crafting to evade KDC anomaly detection.

Server 2025 dMSA / BadSuccessor: Inspects Delegated Managed Service Accounts (msDS-DelegatedManagedSer) and BadSuccessor takeo.

Hybrid Entra ID / Cloud Pivot (!entra)

E dsregcmd /status (AzureAdJoined, DomainJoined, EnterpriseJoined).

Identifies Web Account Manager (WAM) token broker caches (Microsoft.AAD.BrokerPlugin) and Primary Refresh Token (PRT) artifacts.

Extracts Azure CLI (accessTokens.json) and Azure PowerShell credential caches.

---

<a id="platform-features"></a>

Operator Platform Subsystems

In-Band PSRP SOCKS5 Proxy & Port Forwarding (!socks, !portfwd)

!socks 1080: Spawns a local RFC 1928 SOCKS5 proxy multiplexed o WinRM PSRP streams — no listening ports opened on target, zero binary drops.

!portfwd <LPORT> <RHOST>:<RPORT>: Direct local port forwarding to internal subnet targets.

Thread Safety: Hardened with thread-safe mutex locks and socket timeout protection.

Multi-Session Manager & Jump Graph (!session)

!session list: View all acti target runspaces.

!session switch <id>: Switch interacti instantly.

!session exec-all <cmd>: Non-blocking fan-out command execution across all targets with [S:X | Host] output tagging.

!session save: Ephemeral Fernet encrypted session state serialization under ~/.pwnrm/sessions/.

Structured Loot Pipeline (!loot)

Automatically catalogs collected credentials (credentials.json), certificates (.pfx, .pem), Kerberos tickets (.ccache), DPAPI master keys, and memory dumps under ~/.pwnrm/loot/<target>/.

Maintains an operational MANIFEST.json with SHA-256 integrity checksums and timestamped source commands.

OPSEC Profiles & Polymorphic AST Obfuscation (!opsec)

4 Profiles: stealth, balanced, aggressive, hybrid-cloud.

AST Obfuscation: In stealth and hybrid-cloud profiles, automatically inserts dynamic backticks inside cmdlet names (e.g. Get-Process) and randomizes whitespace to defeat static ScriptBlockLogging signatures.

CSPRNG Jitter: Uses secrets module for randomized inter-command delay jitter.

---

<a id="share-scout"></a>

Share Scout (!shares)

!shares runs self-contained SMB share enumeration entirely inside the remote PowerShell session - no extra binaries on target. -q = quick mode.
Covers: local share in via Win32_Share · UNC access testing (read and write probe) · ACL quick-wins flagging E / Authenticated Users write rights · SYS sensitive file sweep · GPP cPassword auto-detection (C) · active SMB sessions (net session).

<a id="session-scout"></a>

Session Scout (!sessions)

!sessions runs self-contained acti session and network snapshot entirely inside the remote PowerShell session. -q = quick mode.
Covers: interactive / remote / service logon sessions via Win32_LogonSession · RDP client MRU and sa from registry · Kerberos ticket cache (klist) · established TCP connections with process attribution · listening port in with service labels (RDP, MSSQL, WinRM, etc.) · named pipe exposure (lsass, spoolss, samr...) · SYSTEM scheduled tasks.

---

<a id="library-usage"></a>

Python Library Usage

PwnRM can be imported directly into Python automation scripts and custom C2 frameworks:

---

Repository Layout

---

<a id="troubleshooting"></a>

Troubleshooting

| Issue | Root Cause | Remediation |
| :--- | :--- | :--- |
| pwnrm: command not found | PATH not configured | Run pip install pwnrm or sudo bash install.sh |
| KRB_AP_ERR_SKEW | Clock desynchronization with KDC | Run sudo ntpdate <DC_IP> or configure chrony |
| WinRM connection refused (5985/5986) | PSRemoting disabled on target | On target: Enable-PSRemoting -Force |
| AMSI catches remote payloads | Strict runtime ScriptBlock inspection | Run !e or !amsi first, or stage via !upload -xor |
| Download stream fails integrity check | Wire corruption / Base64 truncation | WinRM connection MTU or use -ssl for TLS transport |

---

Disclaimer

> [!IMPORTANT]
> PwnRM is designed for authorized security testing, red-team engagements, and educational research only. You must ha written authorization (Rules of Engagement / signed scope) before executing PwnRM against any target infrastructure. The authors assume no liability for misuse.

Credits & License

Author: uziii2208

Underlying Protocol Libraries: Built upon Impacket & pypsrp.

License: MIT — see LICENSE.

<di="center">

ENJOY YOUR MEAL.

</div>

项目信息

开发语言：Python

Star 数：94

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PwnRM is an operator-grade Active Directory post-exploitation platform engineered directly upon the native Microsoft PowerShell Remoting Protocol (MS-PSRP) and WS-Management (MS-WSMV) standards.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。