SharpNoPSExec

SharpNoPSExec

File less command execution for lateral movement.

SharpNoPSExec will query all services and randomly pick one with a start type disable or manual, the current status stopped and with LocalSystem privileges to reuse them.

Once it select the service it will save its current state, replace the binary path with the payload of your choise and execute it.

After waiting 5 seconds it will restore the service configuration and you mostlikely will have your shell :)

This tool is inspired on PSExec explanation from #OSEP for lateralmovement, while reading the exercise I realized I can perform the lateralmovement without touching disk and without creating a new service to avoid detection.

…

Pass the hash Example

https://user-images.githubusercontent.com/29603107/119263799-7d8c9180-bbae-11eb-9f3f-6f272bb8bcd6.mp4

Version 0.0.3

• Added - Sanitization to the input.
• Fixed - Payload it's working with Covenant in a non-interactive.
• Changed - Exit function is a return, removed Enviroment.Exit(0).
• Changed - Logic improvements.

Version 0.0.2

• Fixed - Parsing payload, powershell commands wont execute if they have =.
• Changed - Error handling.

Version 0.0.1

• First release.