DOCSEARCHbyAlgolia
Submit Docs

WinPwn Documentation

repository·master·Indexed 26 days ago

https://github.com/s3cur3th1ssh1t/winpwn

A PowerShell-based post-exploitation framework for internal penetration testing. WinPwn automates reconnaissance and exploitation tasks, featuring built-in proxy support and non-interactive modes for C2 integration with frameworks like Empire, Covenant, or Cobalt Strike. It includes modules for local and domain reconnaissance, privilege escalation, kernel exploits, UAC bypass, and credential dumping.

Tokens
815
Snippets
0
Records
6
Agent score
37%

What's inside WinPwn

  1. Use WinPwn in Non-Interactive/C2 Mode

    master
    To use WinPwn with asynchronous C2 frameworks (like Empire, Covenant, or Cobalt Strike), use the -noninteractive and -consoleoutput parameters. This prevents the script from prompting for user input and ensures all output is returned to the console instead of being written to files.

  2. Install and Import WinPwn

    master

    You can import the WinPwn module directly into your PowerShell session using a local file or by downloading it from the remote repository via a web client.

    For offline environments, use Offline_Winpwn.ps1, which includes the most critical scripts and executables.

  3. Setup a WinPwn Offline Repository

    master

    Use the Get_WinPwn_Repo.sh script to manage a local repository for use in offline environments. This allows you to point WinPwn to a local webserver using the -repo parameter.

    Options:

    • --install: Download the repository to ./WinPwn_Repo/.
    • --remove: Remove the ./WinPwn_Repo/ directory.
    • --reinstall: Remove and re-download the repository.
    • --start-server: Start a Python HTTP server on port 8000.
    • --help: Show help.

  4. Bypass AMSI in WinPwn

    master
    To bypass AMSI (Antimalware Scan Interface), you must manually modify the AMSI trigger in the bypass functions, encode the trigger string, or obfuscate the entire script. Refer to existing bypass techniques and AMSI triggers to customize the implementation.

  5. WinPwn CLI Parameters

    master

    The following parameters are available for WinPwn functions to facilitate automation and C2 integration:

    • -noninteractive: Disables interactive prompts; functions run with predefined or user-defined parameters.
    • -consoleoutput: Prevents the creation of loot/report folders; all function output is returned directly to the console.
    • -repo <URL>: Specifies a local repository URL to use WinPwn features without internet access.

  6. Available WinPwn Functions

    master

    Once imported, the following functions are available for reconnaissance and exploitation:

    • WinPwn: Interactive menu to choose attacks.
    • Inveigh: Executes Inveigh in a new console window (SMB-Relay/Session management).
    • SessionGopher: Executes Sessiongopher with parameter prompts.
    • Kittielocal: Credential dumping (Mimikatz, Safetykatz, Lazagne, Browser, SAM, Wifi) and SharpCloud.
    • Localreconmodules: Local system enumeration (software, shares, network, privileges, event logs, registry, etc.).
    • Domainreconmodules: Domain enumeration (AD-Passwords, Bloodhound, MS17-10, Bluekeep, SQL Server, etc.).
    • Privescmodules: Privilege escalation checks (winPEAS, PowerUp, Dll Hijacking, etc.).
    • kernelexploits: Various kernel exploits (MS15-077, MS16-032, CVE-2020-0796, etc.).
    • UACBypass: UAC bypass techniques (cmstp, DiskCleanup, DccwBypassUAC).
    • SYSTEMShell: Methods to pop a SYSTEM shell (CreateProcess, NamedPipe, Token Manipulation).
    • Shareenumeration: Uses Invoke-Filefinder and Invoke-Sharefinder.
    • Domainshares: Uses Snaffler or Passhunt.
    • Groupsearch: Maps Group Policy to find Admin/RDP access.
    • Kerberoasting: Executes Invoke-Kerberoast.
    • PowerSQL: SQL Server discovery and auditing.
    • Sharphound: Generates Bloodhound 3.0 reports.
    • Adidnsmenu: Manages AD-Integrated DNS Nodes.
    • MS17-10: Scans for Eternalblue vulnerability.
    • Sharpcradle: Loads C# files from a remote webserver to RAM.
    • DomainPassSpray: Executes Domain Password Spray attacks.
    • Bluekeep: Scans for Bluekeep vulnerability.