• Network security, keep an eye on all devices in your company or at home that are confronted with internet.
• Vulnerabilities. And so much more.

• Shodan Eye goes from Python 2 to Python 3
• Save the output of the Shodan Eye results
• The entry of the Shodan password is no longer visible.

• This was written for educational purpose and pentest only.
• The author will not be responsible for any damage ..!
• The author of this tool is not responsible for any misuse of the information.
• You will not misuse the information to gain unauthorized access.
• This information shall only be used to expand knowledge and not for causing malicious or damaging attacks.
• Performing any hacks without written permission is illegal..!

• Download and run Python 3.7.x setup file from Python.org. On Install Python 3.7, enable Add Python 3.7 to PATH.
• Download shodan-eye-master.zip file.>
• Then unzip it.
• Open CMD or PowerShell window at the Osueta folder you have just unzipped and enter these commands:
  pip install shodan
python shodan-eye.py

apt update
apt install -y python3.6 python3-pip git nmap
git clone --recurse-submodules https://github.com/aas-n/spraykatz.git
cd spraykatz
pip3 install -r requirements.txt

./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24

Mandatory arguments

• Mimikatz
• Impacket
• Pypykatz
• Pywerview
• Sysinternals
• hackndo

• First, you must download and run Ruby-lang setup file from RubyInstaller.org, choose Add Ruby executables to your PATH and Use UTF-8 as default external encoding.
• Then, download and install curl (32-bit or 64-bit) from Curl.haxx.se/windows. After that, go to Nmap.org/download.html to download and install the lastest Nmap version.
• Download killshot-master.zip and unzip it.
• Open CMD or PowerShell window at the KillShot folder you've just unzipped and enter these commands:
  ruby setup.rb
ruby killshot.rb

• WinPwn -> Menu to choose attacks:

• Inveigh -> Executes Inveigh in a new Console window , SMB-Relay attacks with Session management (Invoke-TheHash) integrated
• sessionGopher -> Executes Sessiongopher Asking you for parameters
• kittielocal ->
  
  • Obfuscated Invoke-Mimikatz version
  • Safetykatz in memory
  • Dump lsass using rundll32 technique
  • Download and run Lazagne
  • Dump Browser credentials
  • Extract juicy informations from memory
  • Exfiltrate Wifi-Credentials
  • Dump SAM-File NTLM Hashes
• localreconmodules ->
  
  • Collect installed software, vulnerable software, Shares, network information, groups, privileges and many more
  • Check typical vulns like SMB-Signing, LLMNR Poisoning, MITM6 , WSUS over HTTP
  • Checks the Powershell event logs for credentials or other sensitive informations
  • Search for passwords in the registry and on the file system
  • Find sensitive files (config files, RDP files, keepass Databases)
  • Search for .NET Binaries on the local system
  • Optional: Get-Computerdetails (Powersploit) and PSRecon
• domainreconmodules ->
  
  • Collect various domain informations for manual review
  • Find AD-Passwords in description fields
  • Search for potential sensitive domain share files
  • ACLAnalysis
  • Unconstrained delegation systems/users are enumerated
  • MS17-10 Scanner for domain systems
  • SQL Server discovery and Auditing functions (default credentials, passwords in the database and more)
  • MS-RPRN Check for Domaincontrollers
  • Group Policy Audit with Grouper2
  • An AD-Report is generated in CSV Files (or XLS if excel is installed) with ADRecon.
• Privescmodules -> Executes different privesc scripts in memory (PowerUp Allchecks, Sherlock, GPPPasswords)
• latmov -> Searches for Systems with Admin-Access in the domain for lateral movement. Mass-Mimikatz can be used after for the found systems
• shareenumeration -> Invoke-Filefinder and Invoke-Sharefinder (Powerview / Powersploit)
• groupsearch -> Get-DomainGPOUserLocalGroupMapping - find Systems where you have Admin-access or RDP access to via Group Policy Mapping (Powerview / Powersploit)
• Kerberoasting -> Executes Invoke-Kerberoast in a new window and stores the hashes for later cracking
• powerSQL -> SQL Server discovery, Check access with current user, Audit for default credentials + UNCPath Injection Attacks
• Sharphound -> Downloads Sharphound and collects Information for the Bloodhound DB
• adidnswildcard -> Create a Active Directory-Integrated DNS Wildcard Record
• MS17-10 -> Scan active windows Servers in the domain or all systems for MS17-10 (Eternalblue) vulnerability
• Sharpcradle -> Load C# Files from a remote Webserver to RAM
• DomainPassSpray -> DomainPasswordSpray Attacks, one password for all domain users

• Some obfuskation
• More obfuscation
• Proxy via PAC-File support
• Get the scripts from my own creds repository (https://github.com/S3cur3Th1sSh1t/Creds) to be independent from changes in the original repositories
• More Recon/Exploitation functions
• Add MS17-10 Scanner
• Add menu for better handling of functions
• Amsi Bypass
• Mailsniper integration
• Azure Checks / Modules integration

• Kevin-Robertson - Inveigh, Powermad, Invoke-TheHash
• Arvanaghi - SessionGopher
• PowerShellMafia - Powersploit
• Dionach - PassHunt
• A-mIn3 - WINSpect
• 411Hall - JAWS
• sense-of-security - ADrecon
• dafthack - DomainPasswordSpray
• rasta-mouse - Sherlock
• AlessandroZ - LaZagne
• samratashok - nishang
• leechristensen - Random Repo
• HarmJ0y - Many good Blogposts, Gists and Scripts
• NETSPI - PowerUpSQL
• Cn33liz - p0wnedShell
• rasta-mouse - AmsiScanBufferBypass
• l0ss - Grouper2
• dafthack - DomainPasswordSpray
• enjoiz - PrivEsc

• c0r3dump3d: coredump@autistici.org
• rofen: rofen@gmx.de

• Install Python 2.7.x from Python.org first. On Install Python 2.7.x Setup, choose Add python.exe to Path.
• Download Osueta-master zip file.
• Then unzip it.
• Open CMD or PowerShell window at the Osueta folder you have just unzipped and enter these commands:
  pip install python-nmap paramiko IPy
python osueta.py -h