pwnrm 1.0.1__tar.gz

pwnrm-1.0.1/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Hoang G.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pwnrm-1.0.1/PKG-INFO

@@ -0,0 +1,408 @@
+Metadata-Version: 2.4
+Name: pwnrm
+Version: 1.0.1
+Summary: Advanced WinRM / AD Post-Exploitation Shell
+Author: uziii2208
+License: MIT
+Project-URL: Homepage, https://github.com/uziii2208/PwnRM
+Project-URL: Repository, https://github.com/uziii2208/PwnRM
+Project-URL: Issues, https://github.com/uziii2208/PwnRM/issues
+Keywords: winrm,activedirectory,pentest,redteam,impacket
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.md
+Requires-Dist: impacket>=0.11.0
+Requires-Dist: requests>=2.28.0
+Requires-Dist: urllib3>=1.26.0
+Requires-Dist: pyasn1>=0.4.8
+Requires-Dist: pycryptodomex>=3.18.0
+Requires-Dist: cryptography>=41.0.0
+Requires-Dist: prompt-toolkit>=3.0.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: build>=1.0.0; extra == "dev"
+Requires-Dist: twine>=4.0.0; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+
+<img src="photos/image.png" alt="PwnRM Banner" width="720"/>
+
+# PwnRM
+
+**Advanced WinRM Post-Exploitation Shell for Windows Active Directory Testing**
+
+[![Stars](https://img.shields.io/github/stars/uziii2208/PwnRM?style=for-the-badge&color=gold&logo=github)](https://github.com/uziii2208/PwnRM/stargazers)
+[![Forks](https://img.shields.io/github/forks/uziii2208/PwnRM?style=for-the-badge&color=blue&logo=github)](https://github.com/uziii2208/PwnRM/network/members)
+[![Issues](https://img.shields.io/github/issues/uziii2208/PwnRM?style=for-the-badge&color=red&logo=github)](https://github.com/uziii2208/PwnRM/issues)
+[![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge&logo=opensourceinitiative)](LICENSE)
+[![Version](https://img.shields.io/badge/Version-1.0.0-purple?style=for-the-badge)](https://github.com/uziii2208/PwnRM/releases)
+[![Platform](https://img.shields.io/badge/Platform-Linux-orange?style=for-the-badge&logo=linux)](https://github.com/uziii2208/PwnRM)
+[![Python](https://img.shields.io/badge/Python-3.10%2B-blue?style=for-the-badge&logo=python)](https://www.python.org/)
+
+> **PwnRM** is a fully rewritten, operator-grade WinRM execution framework built for **advanced Windows Active Directory security assessments**. It combines a rich interactive shell with a built-in AD triage engine, Kerberos/NTLM/CredSSP transport layer, and stealthy .NET / PowerShell payload delivery — all from a single Python binary.
+
+[Features](#-features) · [Installation](#-installation) · [Usage](#-usage) · [Commands](#-commands) · [AD Triage](#-ad-triage-new-in-v100) · [Changelog](#-changelog) · [Disclaimer](#%EF%B8%8F-disclaimer)
+
+</div>
+
+---
+
+## What is PwnRM?
+
+PwnRM is a post-exploitation shell for **authorized red-team and penetration testing** of Windows environments. It targets the **WS-Management (WinRM) protocol** and communicates natively over MS-PSRP (PowerShell Remoting Protocol), giving you a full PowerShell runspace without spawning `powershell.exe` as a visible process.
+
+Built on top of [Impacket](https://github.com/fortra/impacket), PwnRM supports every modern AD authentication path — NTLM, Pass-the-Hash, Kerberos ccache, CredSSP, and client-certificate mutual auth (ADCS abuse) — and ships with a self-contained **AD Triage module** that enumerates the most critical Active Directory attack paths without requiring any additional tooling on the target.
+
+### Why PwnRM over evil-winrm?
+
+| Capability | PwnRM v1.0.0 | evil-winrm |
+|---|:---:|:---:|
+| Pure Python (no Ruby) | ✅ | ❌ |
+| Kerberos ccache / PtH | ✅ | ✅ |
+| CredSSP transport | ✅ | ❌ |
+| Client-cert (.pfx) mutual auth | ✅ | ❌ |
+| Built-in AD Triage (no BloodHound needed) | ✅ | ❌ |
+| AMSI bypass | ✅ | ✅ |
+| .NET assembly loader | ✅ | ✅ |
+| Session metadata + tab-completion | ✅ | ❌ |
+| Channel binding (EPA) | ✅ | ❌ |
+| No PowerShell history (`AddToHistory=false`) | ✅ | ❌ |
+
+---
+
+## Features
+
+### Shell & Connectivity
+- **Interactive PowerShell runspace** over WS-Management / MS-PSRP — no `powershell.exe` process visible on target
+- **Tab-completion** for all built-in commands via `prompt_toolkit`
+- **Session metadata** — uptime, command counter, active target info in the prompt
+- **Session transcript** — structured log of every command and output
+
+### Authentication
+- **NTLM** (password or NT hash — Pass-the-Hash)
+- **Kerberos** — ccache file (`-k --ccache`) or `KRB5CCNAME` environment variable
+- **CredSSP** — full credential delegation (useful for double-hop scenarios)
+- **Client certificate mutual auth** — `.pfx` files from ADCS abuse paths (ESC1, ESC9, Shadow Credentials)
+- **Channel binding (EPA)** on HTTPS targets — compatible with Server 2022+ hardened configs
+
+### Payload Delivery
+- **`!upload` / `!download`** — chunked XOR-obfuscated file transfer with MD5 verification; directory download auto-zips
+- **`!amsi`** — patches `AmsiScanBuffer` in the remote process via reflective DllImport
+- **`!psrun`** — streams and executes remote PowerShell scripts inside an obfuscated `ScriptBlock` to evade logging
+- **`!netrun`** — loads and invokes remote .NET assemblies with console output hijack
+- **`!revshell`** — raw Winsock reverse shell via `CreateProcess` + `WSAConnect` — full stdin/stdout/stderr
+
+### AD Triage (`!adtriage`)
+Built-in, no-extra-tools AD enumeration engine. See the [full section](#-ad-triage-new-in-v100) below.
+
+---
+
+## Installation
+
+### Requirements
+
+- **OS**: Kali Linux, Parrot OS, Ubuntu 22.04+, Debian 11+ (or any Linux with Python 3.10+)
+- **Python**: 3.10+
+- **Root/sudo**: required for the installer
+
+### Quick Install
+
+```bash
+git clone https://github.com/uziii2208/PwnRM.git
+cd PwnRM
+sudo bash install.sh
+```
+
+The installer sets up a virtual environment at `/opt/pwnrm` and registers a global `pwnrm` wrapper.
+
+### Manual Install
+
+```bash
+git clone https://github.com/uziii2208/PwnRM.git
+cd PwnRM
+python3 -m venv venv && source venv/bin/activate
+pip install -r requirements.txt
+python3 pwnrm -h
+```
+
+### Python Dependencies
+
+```
+impacket>=0.12.0
+prompt_toolkit>=3.0.0
+pycryptodomex>=3.20.0
+requests>=2.31.0
+cryptography>=42.0.0
+pyasn1>=0.6.0
+```
+
+---
+
+## Usage
+
+### Basic Syntax
+
+```
+pwnrm [[domain/]username[:password]@]<target> [options]
+```
+
+### Authentication Examples
+
+```bash
+# Password
+pwnrm -u Administrator -p 'P@ssw0rd!' 192.168.1.10
+
+# Pass-the-Hash (NT hash only)
+pwnrm -u Administrator -H :aad3b435b51404eeaad3b435b51404ee dc01.corp.local
+
+# Kerberos via ccache
+export KRB5CCNAME=/tmp/administrator.ccache
+pwnrm -u administrator@CORP.LOCAL -k dc01.corp.local
+
+# Kerberos with explicit ccache path
+pwnrm -u administrator@CORP.LOCAL -k --ccache /tmp/admin.ccache dc01.corp.local
+
+# Client certificate from ADCS abuse (ESC1 / ESC9 / Shadow Credentials)
+pwnrm -u administrator@CORP.LOCAL --pfx administrator.pfx --pfx-pass MySecret https://dc01.corp.local:5986
+
+# CredSSP (double-hop / credential delegation)
+pwnrm -u admin -p 'P@ss' --credssp dc01.corp.local
+
+# Run single command (non-interactive)
+pwnrm -u admin -p 'P@ss' dc01.corp.local -X "whoami /all"
+```
+
+### Connection Options
+
+```
+--port PORT        Override WinRM port (default: 5985 HTTP, 5986 HTTPS)
+--ssl              Force HTTPS
+--timeout SEC      Per-request timeout (default: 30)
+--debug            Verbose output
+--ts               Timestamp all log entries
+```
+
+---
+
+## Commands
+
+Once connected, use these built-in commands inside the shell:
+
+### File Operations
+
+| Command | Description |
+|---|---|
+| `!download RPATH [LPATH]` | Pull file or directory from target. Directories are automatically zipped. Paths with spaces must be quoted. |
+| `!upload [-xor] LPATH [RPATH]` | Push a local file to the target. Use `-xor` when staging encrypted payloads for `!psrun`/`!netrun`. |
+
+### Code Execution
+
+| Command | Description |
+|---|---|
+| `!amsi` | Patch `AmsiScanBuffer` in the remote PowerShell process. Run this before loading .NET assemblies or obfuscated scripts. |
+| `!psrun [-xor] URL` | Download and execute a PowerShell script via URL using obfuscated ScriptBlock invocation. |
+| `!netrun [-xor] URL [ARG..]` | Download and invoke a .NET assembly with optional arguments. Console output is captured via a custom `TextWriter`. |
+| `!revshell IP PORT` | Spawn a raw Winsock reverse shell with full I/O redirection (`stdin`/`stdout`/`stderr`). Use `nc -lvnp PORT` on your listener. |
+
+### AD Reconnaissance
+
+| Command | Description |
+|---|---|
+| `!adtriage` | Full AD enumeration: identity, groups, SPNs, AS-REP, delegation, ADCS, gMSA/dMSA, ACLs. |
+| `!adtriage -q` | Quick mode — identity, domain basics, and Server 2025 / BadSuccessor check only. |
+| `!sysinfo` | OS build, hotfixes, AV products, local admins, SMB/WinRM configuration. |
+| `!creds` | Scans for DPAPI blobs, PowerShell history, `web.config`, `unattend.xml`, `ntds.dit`, `cmdkey` entries. |
+
+### Session Management
+
+| Command | Description |
+|---|---|
+| `!log` | Start logging session transcript to `pwnrm_<timestamp>_stdout.log`. |
+| `!stoplog` | Stop transcript logging. |
+| `!help` / `?` | Show built-in help with session metadata. |
+| `exit` / `quit` / `Ctrl+D` | Close the remote session gracefully. |
+| `Ctrl+C` | Interrupt the currently running remote command. Repeated Ctrl+C force-terminates. |
+
+---
+
+## AD Triage (New in v1.0.0)
+
+`!adtriage` is PwnRM's signature feature: a **self-contained Active Directory enumeration engine** that runs entirely inside the remote PowerShell session using only built-in .NET and ADSI/LDAP calls — no Sharphound, no BloodHound, no extra binaries on the target.
+
+### What it covers
+
+```
+1.  Identity & session         — current user, SID, groups, privileges
+2.  Domain basics              — domain, forest, DCs, external trusts
+    ↳ OS version check         — flags Windows Server 2025 → BadSuccessor hint
+3.  High-value group members   — Domain Admins, Enterprise Admins, DNSAdmins, etc.
+4.  Kerberoastable accounts    — user objects with SPNs, adminCount, password age
+5.  AS-REP roastable           — DONT_REQ_PREAUTH accounts
+6.  Unconstrained delegation   — coercion + TGT capture targets
+7.  Constrained delegation     — S4U2Self / protocol-transition paths
+8.  RBCD                       — msDS-AllowedToActOnBehalfOfOtherIdentity write targets
+9.  ADCS template scan         — ESC1 (enrollee-supplied SAN), ESC3 (cert request agent),
+                                 ESC4 (published templates — flag for Certipy)
+10. gMSA / dMSA                — gMSA password read targets; dMSA BadSuccessor targets
+11. ACL quick-wins             — GenericAll / GenericWrite / WriteDACL on DA/DC/krbtgt
+12. Pre-Windows 2000 compat    — Anonymous LDAP read vulnerability check
+13. Password-never-expires     — adminCount=1 accounts with infinite passwords
+    ↳ Printed next steps       — Kerberoast / AS-REP / ADCS / BadSuccessor / BloodHound
+```
+
+### Sample output
+
+```
+========================================================================
+  [*] Identity & Session
+========================================================================
+  [+] User     : CORP\svc_backup
+  [+] SID      : S-1-5-21-...
+  [+] Groups   : CORP\Backup Operators, ...
+  [+] Privs    : SeBackupPrivilege, SeRestorePrivilege
+
+========================================================================
+  [*] Unconstrained Delegation
+========================================================================
+  [!] FILESRV01$  ← coerce + capture TGT → DCSync
+
+========================================================================
+  [*] ADCS — Vulnerable Certificate Templates
+========================================================================
+  [!] ESC1 candidate : UserAuth  (enrollee supplies SAN + Client Auth)
+  [!] ESC3 candidate : EnrollAgent  (Certificate Request Agent EKU)
+
+========================================================================
+  [*] gMSA / dMSA Accounts
+========================================================================
+  [+] gMSA: svc_adfs$
+  [!] dMSA: svc_itsupport$ ← potential BadSuccessor target
+```
+
+---
+
+## Directory Structure
+
+```
+PwnRM/
+├── pwnrm                   # Main entry point (CLI + PwnShell class)
+├── core.py                 # Transport layer, Runspace, credential helpers
+├── requirements.txt        # Python dependencies
+├── install.sh              # One-line installer (Kali / Debian / Ubuntu)
+├── photos/
+│   └── image.png           # Banner screenshot
+└── README.md               # This file
+```
+
+---
+
+## Troubleshooting
+
+**`pwnrm: command not found`**
+```bash
+sudo bash /opt/pwnrm/install.sh
+```
+
+**Python import errors**
+```bash
+source /opt/pwnrm/venv/bin/activate
+pip install -r /opt/pwnrm/requirements.txt
+```
+
+**`KRB_AP_ERR_SKEW` / Kerberos clock skew**
+```bash
+sudo ntpdate <DC_IP>        # or: sudo rdate -n <DC_IP>
+```
+
+**WinRM connection refused**
+```powershell
+# On the target (as Administrator):
+Enable-PSRemoting -Force
+Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
+```
+
+**AMSI detection when loading assemblies**
+Run `!amsi` before `!netrun` or `!psrun`. If AMSI is still catching payloads, XOR-encrypt the payload first with `!upload -xor` and then load it with `!netrun -xor`.
+
+---
+
+## Changelog
+
+### v1.0.0 (2026-08-15)
+- **New**: `!adtriage` — self-contained AD post-auth enumeration engine (13 checks, no extra binaries)
+- **New**: `!sysinfo` — OS/AV/hotfix/SMB snapshot command
+- **New**: `!creds` — DPAPI artifact and credential file scanner
+- **New**: Kerberos ccache transport (`-k` / `--ccache`)
+- **New**: Client-certificate mutual-auth transport (`--pfx` / `--pfx-pass`) — ADCS abuse ready
+- **New**: CredSSP transport (`--credssp`) for double-hop scenarios
+- **New**: Pass-the-Hash via `-H NTHASH` flag (previously required inline in target string)
+- **New**: Tab-completion via `prompt_toolkit` WordCompleter
+- **New**: Session metadata (uptime, command counter) in banner and prompt
+- **New**: Channel binding (EPA/GSS bindings) for HTTPS targets — compatible with Server 2022+
+- **Improved**: `AddToHistory=false` in all pipeline requests — cleaner OPSEC footprint
+- **Improved**: `argument_parser()` overhauled — all auth modes exposed as clean flags
+- **Improved**: `_decrypted_response()` handles both tab and space prefixes in MIME multipart
+- **Improved**: Full ANSI colour palette for clear output differentiation (green=success, yellow=warn, red=error, cyan=info)
+- **Improved**: README completely rewritten with badges, comparison table, and per-command docs
+
+---
+
+## ⚠️ Disclaimer
+
+PwnRM is developed for **authorized security testing, red-team operations, and educational purposes only**.
+
+- You must have **explicit written authorization** (Rules of Engagement / signed scope) before running PwnRM against any system.
+- The authors assume **no liability** for misuse, damage, or unauthorized use.
+- **Never use against systems you do not own or lack permission to test.**
+
+---
+
+## Credits
+
+| Contributor | Role |
+|---|---|
+| **uziii2208** | Core author, v1.0.0 rewrite |
+| **Impacket / SecureAuth** | WinRM / Kerberos / NTLM protocol library |
+| **fortra/impacket** | Upstream dependency |
+| Original `winrmexec.py` | Concept and initial reference |
+
+---
+
+## License
+
+```
+MIT License — Copyright (c) 2025 uziii2208
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished
+to do so, subject to the following conditions: The above copyright notice and
+this permission notice shall be included in all copies or substantial portions
+of the Software.
+```
+
+---
+
+<div align="center">
+
+**ENJOY YOUR MEAL 🍖**
+
+*Made with ☕ and too many late nights — for the red team community.*
+
+[![GitHub](https://img.shields.io/badge/GitHub-uziii2208-black?style=flat-square&logo=github)](https://github.com/uziii2208)
+
+</div>