GET YOUR VULNERABILITY AND THREAT DATABASE SUBSCRIPTION
EKOLABS 2016


Network Security

Published on April 4th, 2016 | by NJ Ouchn

0

Pentestly Framework – Pentesting powered by Python and Powershell

Pentestly is a combination of expanding Python tools for use in penetration tests. The goal is to utilize a familiar user interface while making contributions to the framework easy with the power of Python.

Current features

  • Import NMAP XML
  • Test SMB authentication using:
    • individual credentials
    • file containing credentials
    • null credentials
    • NTLM hash
  • Test local administrator privileges for successful SMB authentication
  • Identify readable SMB shares for valid credentials
  • Store Domain/Enterprise Admin account names
  • Determine location of running Domain Admin processes
  • Determine systems of logged in Domain Admins
  • Execute Powershell commands in memory and exfil results
  • Execute Mimikatz to gather plaintext password from memory (Invoke-Mimikatz.ps1)
  • Receive a command shell (Powercat)
  • Receive a meterpreter session (Invoke-Shellcode.ps1)

Below are the current tools utilized in Pentestly:

  • recon-ng – Backend database for recon-ng is beautifully made and leveraged in Pentestly for data manipulation
  • wmiexec.py – Allows us to execute Powershell commands quickly and easily via WMI
  • smbmap.py – Useful utility for enumerating SMB shares
  • Invoke-Mimikatz.ps1 – Implementation of Mimikatz in Powershell

Tags: , , , , ,


About the Author

“Passion is needed for any great work, and for the revolution, passion and audacity are required in big doses”



Leave a Reply

Your email address will not be published. Required fields are marked *

Back to Top ↑