awesome-windows-red-team - A curated list of awesome Windows frameworks, lib

项目说明

Awesome Windows Red Team ![Awesome]()

> A curated list of awesome Windows talks, tools and resources for Red Teams, from beginners to ninjas.

Contents

* Books
* Courses
* System Architecture
* Acti
* Kerberos
* Lssass SAM NTLM GPO
* WinAPI
* Lateral Mo
* Pass the Hash
* Pass the Ticket
* LLMNR/NBT-NS poisoning
* Pri Escalation
* UAC bypass
* Token Impersonation
* Defense E
* A
* AMSI
* Exfiltration
* PowerShell
* Phishing
* Maldocs
* Macros
* DDE
* HTA
* Tools

Books

* Windows Internals, Seventh Edition, Part 1
* Windows Internals, Sixth Edition, Part 1
* Windows Internals, Sixth Edition, Part 2
* How to Hack Like a PORNSTAR: A step by step process for breaking into a BANK
* Windows® via C/C++ (De Reference) (English Edition)
* The Hacker Playbook 3: Practical Guide To Penetration Testing

Courses

* Professor Messer's CompTIA SY0-501 Security+ Course
* Penetration Testing with Kali (PWK) Online Security Training Course
* Offensi Certified Expert
* Ad Windows Exploitation: Li Penetration Testing Training
* Windows API Exploitation Recipes: Processes, Tokens and Memory RW
* Powershell for Pentesters - Pentester Academy
* WMI Attacks and Defense - Pentester Academy
* Windows Red Team Lab - Pentester Academy

System Architecture

Acti

* ADsecurity.org
* DerbyCon4 - How to Secure and Sys Admin Windows like a Boss
* DEFCON 20: Owned in 60 Seconds: From Network Guest to Windows Domain Admin
* BH2015 - Red Vs. Blue: Modern Acti Attacks, Detection, And Protection
* BH2016 - Beyond the Mcse: Acti for the Security Professional
* BH2017 - E Microsoft ATA for Acti Domination
* DEFCON 26 - Exploiting Acti Administrator Insecurities
* BH2017 - An ACE Up the Slee Acti DACL Backdoors
* DerbyCon7 - Building the DeathStar getting Domain Admin with a push of a button (aka how I almost automated myself out pf a job)
* DerbyCon4 - Abusing Acti in Post Exploitation

Kerberos

* Kerberos (I): How does Kerberos work? – Theory
* Protecting Pri Domain Accounts: Network Authentication In-Depth
* Basic attacks on communication protocols – replay and reflection attacks
* MicroNugget: How Does Kerberos Work?
* MIT 6.858 Fall 2014 Lecture 13: Kerberos
* DerbyCon4 - Et tu Kerberos
* DerbyCon7 - Return From The Underworld The Future Of Red Team Kerberos
* BH2014 - Abusing Microsoft Kerberos: Sorry You Guys Don't Get It
* DerbyCon4 - Attacking Microsoft Kerberos Kicking the Guard Dog of Hades
* Kerberos in the Crosshairs: Golden Tickets, Sil, MITM, and More
* How Attackers Use Kerberos Sil to Exploit Systems

Lsass SAM NTLM GPO

* Retrieving NTLM Hashes without touching LSASS: the “Internal Monologue” Attack
* ATT&CK - Credential Dumping
* BH2002 - Cracking NTLMv2 Authentication
* DerbyCon7 - Securing Windows with Group Policy
* Abusing GPO Permissions
* Targeted Kerberoasting

WinAPI

* DerbyCon4 - Getting Windows to Play with Itself: A Pen Testers Guide to Windows API Abuse

Lateral Mo

Pass the Hash

* ATT&CK - Pass the Hash
* BH2013 - Pass the Hash and other credential theft and reuse: Pre Lateral Mo...
* BH2013 - Pass the Hash 2: The Admin's Revenge
* From Pass-the-Hash to Pass-the-Ticket with No Pain
* Pass-the-Hash Is Dead: Long LierPolicy

Pass the Ticket

* ATT&CK - Pass the Ticket

LLMNR/NBT-NS poisoning

* An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit

Pri Escalation

* Level Up! Practical Windows Pri Escalation - Andrew Smith
* Windows Pri Escalation Presentation
* Windows Kernel Exploits
* DEF CON 22 - Kallenberg and Kovah - Extreme Pri Escalation On Windows 8/UEFI Systems
* DEF CON 25 - Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
* DerbyCon7 - Not a Security Boundary Bypassing User Account Control

Token Impersonation

* Fun with Incógnito
* Rotten Potato

Defense E

AV

* DerbyCon3 - Antivirus E Lessons Learned
* DerbyCon7 - T110 Modern E Techniques
* DerbyCon7 - E Autoruns
* Red Team Techniques for E, Bypassing & Disabling MS
* How to Bypass Anti-Virus to Run Mimikatz
* A - Obfuscating Mimikatz
* Getting PowerShell Empire Past Windows Defender

AMSI

* Windows Defender ATP machine learning and AMSI: Unearthing script-based attacks that ‘live off the land’
* [Antimalware Scan Interface (AMSI) — A Red Team Analysis on E] ()

LAPS

* Local Administrator Password Solution)
* Malicious use of Microsoft LAPS

AppLocker & Application Whitelisting

* What Is AppLocker?
* How to Evade Application Whitelisting Using REGSVR32
* UltimateAppLockerByPassList

Exfiltration

* Abusing Windows Management Instrumentation (WMI)
* DEF CON 23 - Panel - WhyMI so Sexy: WMI Attacks - Real Time Defense and Ad Forensics
* DerbyCon3 - Living Off The Land A Minimalist's Guide To Windows Post Exploitation

PowerShell

* DEF CON 18 - Da "ReL1K" & Josh Kelley - Powershell...omfg
* DEF CON 22 - In PowerShell Attacks
* DerbyCon2016 - 106 PowerShell Secrets and Tactics Ben0xA
* Daniel Bohannon – In: PowerShell obFUsk8tion
* BH2017 - Re: PowerShell Obfuscation Detection (And E) Using Science

Phishing

Maldocs

* Phishing with Maldocs
* Phishing with Empire

Macros

* Phishing with Macros and Powershell

DDE

* About Dynamic Data Exchange
* Abusing Microsoft Office DDE
* Microsoft Office Dynamic Data Exchange(DDE) attacks
* Office-DDE-Payloads

HTA

* Hacking around HTA files

Tools

* Mimikatz
* BloodHound
* Empire
* Nishang
* Responder
* CrackMapExec
* PSExec

Ad Emulation

* Cobalt Strike
* Darkmoon
* Red Team Automation - RTA
* CALDERA
* Atomic Red Team
* Metta

Other Awesome Lists & sources

* Awesome Red Teaming
* Red Teaming Toolkit
* Red Team Infrastructure Wiki
* Awesome Pentest
* Red Teaming Experiments

Contributing

Your contributions are always welcome! Please take a look at the contribution guidelines first.

If you have any question about this opinionated list, do not hesitate to contact me @\_mvalle\_ on Twitter or open an issue on GitHub.

项目信息

开发语言：未知

Star 数：607

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕 A curated list of awesome Windows frameworks, libraries, software and resources for Red Teams展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。