> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# GhostPack
> A collection of C# offensive security tools for Windows and Active Directory environments
GhostPack is a collection of security tools primarily authored by [@harmj0y](https://twitter.com/harmj0y) and the SpecterOps team. These tools should only be used in authorized security testing or educational environments.
## Overview
GhostPack is a renowned collection of offensive security tools written primarily in C# for Windows and Active Directory environments. These tools assist security professionals in penetration testing, red teaming, and security auditing, covering everything from Kerberos attacks to credential extraction and privilege escalation.
Comprehensive suite of specialized security utilities
Built on .NET Framework for Windows environments
Regularly updated with new features and improvements
Community-driven with contributions from security researchers
***
## 📖 Fully Documented Tools
These GhostPack tools have comprehensive documentation available in this wiki:
### 🎭 Kerberos & Authentication
**"Trying to tame the three-headed dog"**
Comprehensive toolkit for raw Kerberos interaction and abuse. Supports ticket requests, extraction, manipulation, roasting (Kerberoast/AS-REP roast), delegation abuse, and golden/silver/diamond ticket operations.
**Commands:** asktgt, asktgs, dump, ptt, kerberoast, asreproast, s4u, golden, silver, diamond, and more
**Active Directory Certificate Services (AD CS) Attacks**
Identifies and exploits misconfigurations in AD CS environments. Comprehensive coverage of all known AD CS attack techniques (ESC1-ESC16).
**Techniques:** Certificate abuse, persistence, domain persistence, privilege escalation via certificates
### 🔐 Credential Access & Extraction
**DPAPI Credential Extraction**
C# toolkit for interacting with Windows Data Protection API (DPAPI). Extracts credentials from vaults, Chrome browsers, RDG files, KeePass databases, certificates, and SCCM secrets.
**Commands:** triage, masterkeys, credentials, vaults, rdg, keepass, certificates, sccm
**Mimikatz with .NET PE Loader**
Combination of a modified Mimikatz with @subTee's .NET PE Loader for in-memory credential extraction with OPSEC considerations.
**Features:** In-memory execution, credential dumping, minimal disk writes
### 🔍 Enumeration & Reconnaissance
**Host Enumeration & Safety Checks**
Comprehensive Windows security enumeration tool with 120+ commands. Performs "safety checks" for both offensive and defensive security perspectives.
**Groups:** System, User, Misc, Chromium, Slack, Remote
**Privilege Escalation Enumeration**
C# port of PowerUp functionality. Identifies common Windows privilege escalation vectors without weaponization.
**15 Checks:** Services, registry, credentials, DLL hijacking, tokens
**WMI Operations**
C# implementation of WMI functionality for enumeration, lateral movement, and remote execution with AMSI evasion.
**Actions:** query, exec, ps, firewall, upload, install, environment variables
***
## 🛠️ Additional GhostPack Tools
The following tools are part of the GhostPack collection. Full documentation coming soon:
### Credential & Certificate Tools
**Golden Certificates**
Forge certificates for arbitrary users using stolen CA certificates and private keys. Create persistent backdoors via certificate abuse.
**KeePass Attack Methods**
Methods for attacking KeePass 2.X databases, including extracting encryption key material from memory and master keys.
### Utility Tools
**Locked File Access**
Allows copying of locked files without triggering file locks. Useful for exfiltrating files that are normally inaccessible.
**Process Memory Dumping**
C# port of PowerSploit's Out-Minidump.ps1 for dumping process memory, particularly useful for LSASS dumping.
**AD CS Auditing**
PowerShell toolkit for Active Directory Certificate Services auditing based on the PSPKI toolkit.
**Password Analysis**
Password extraction and analysis utilities for security assessments.
### Deprecated Tools
**SharpRoast** was a C# port of PowerView's Kerberoasting functionality. This functionality has been superseded by Rubeus, which provides more comprehensive Kerberos attack capabilities.
Use [Rubeus kerberoast](/ghostpack-docs/Rubeus-mdx/commands/roasting/kerberoast) instead.
### Research & POC Tools
**Nemesis-powered RAG Chatbot**
A Retrieval-Augmented Generation (RAG) chatbot proof-of-concept powered by Nemesis for offensive security operations.
**Restricted Admin Research**
Tools and research around Windows Restricted Admin mode and related security mechanisms.
***
## 🎯 Tools by Use Case
**Credential Harvesting:**
* [SharpDPAPI](/ghostpack-docs/SharpDPAPI-mdx/overview) - Extract saved credentials
* SafetyKatz - Dump credentials from memory
* KeeThief - Extract KeePass master keys
**Remote Execution:**
* [SharpWMI](/ghostpack-docs/SharpWMI-mdx/overview) - WMI-based lateral movement
* [Rubeus](/ghostpack-docs/Rubeus-mdx/overview) - Kerberos ticket manipulation
**Process Manipulation:**
* SharpDump - Memory dumping
* Lockless - Locked file access
**Long-term Access:**
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/forgery/golden) - Golden tickets
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/forgery/silver) - Silver tickets
* [Certify](/ghostpack-docs/Certify.wik-mdx/2-account-persistence-techniques) - Certificate persistence
* ForgeCert - Golden certificates
**Escalation Vectors:**
* [SharpUp](/ghostpack-docs/SharpUp-mdx/overview) - Privilege escalation enumeration
* [Certify](/ghostpack-docs/Certify.wik-mdx/4-escalation-techniques) - AD CS exploitation (ESC1-ESC16)
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/delegation/s4u) - Delegation abuse
**Credential Theft:**
* [SharpDPAPI](/ghostpack-docs/SharpDPAPI-mdx/overview) - DPAPI secrets
* SafetyKatz - Memory credentials
**Kerberos Attacks:**
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/roasting/kerberoast) - Kerberoasting
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/roasting/asreproast) - AS-REP roasting
* [Rubeus](/ghostpack-docs/Rubeus-mdx/commands/extraction/dump) - Ticket extraction
**DPAPI Extraction:**
* [SharpDPAPI](/ghostpack-docs/SharpDPAPI-mdx/commands/credentials) - Windows credentials
* [SharpDPAPI](/ghostpack-docs/SharpDPAPI-mdx/sharpchrome-overview) - Chrome passwords
* [SharpDPAPI](/ghostpack-docs/SharpDPAPI-mdx/commands/keepass) - KeePass databases
**Host Enumeration:**
* [Seatbelt](/ghostpack-docs/Seatbelt-mdx/overview) - Comprehensive system checks (120+ commands)
* [SharpWMI](/ghostpack-docs/SharpWMI-mdx/actions/query) - WMI queries
* [SharpUp](/ghostpack-docs/SharpUp-mdx/overview) - Privilege escalation vectors
**AD Enumeration:**
* [Certify](/ghostpack-docs/Certify.wik-mdx/Home) - AD CS enumeration
* PSPKIAudit - PKI auditing
***
## 🚀 Getting Started
Select the appropriate tool for your assessment needs from the categories above
Read the comprehensive documentation for each tool (links in the tool cards)
**Option 1: Clone and Build**
```bash theme={null}
git clone https://github.com/GhostPack/[TOOL_NAME]
cd [TOOL_NAME]
```
Open in Visual Studio and build, or use .NET CLI:
```bash theme={null}
dotnet build
```
**Option 2: Pre-compiled Binaries**
Pre-compiled binaries may be available from community repositories
Each tool has detection considerations documented. Review before operational use.
Only use tools during authorized penetration tests or in controlled lab environments
***
## 🎓 Learning Resources
Official GhostPack repositories with source code and individual tool documentation
Research articles, attack techniques, and tool announcements from the SpecterOps team
Community discussions, tool support, and collaboration with other security professionals
Comprehensive AD CS research paper by Will Schroeder & Lee Christensen (basis for Certify)
Personal blog of @harmj0y with deep technical articles on Windows and AD security
Professional training from SpecterOps covering GhostPack tools and attack techniques
***
## ⚠️ Operational Security
**Detection Considerations**
All GhostPack tools generate telemetry that can be detected by EDR, SIEM, and other security monitoring solutions. Review the detection sections in each tool's documentation before operational use.
**Common Detection Vectors:**
* **Process Creation**: C# executable launches
* **Command Line**: Tool-specific arguments and parameters
* **Network Traffic**: Kerberos requests, WMI connections
* **Registry Access**: Service queries, autorun enumeration
* **File System**: DPAPI blob reads, credential file access
* **Memory Operations**: LSASS access, process injection
* **Windows Events**: Security logs, Sysmon, PowerShell logging
**OPSEC Recommendations:**
* Use tools from memory when possible
* Consider obfuscation for critical operations
* Space out enumeration activities
* Blend with normal admin activity patterns
* Review tool-specific OPSEC guidance in documentation
***
## 🤝 Contributing
GhostPack welcomes contributions from the security community:
Fork the specific tool repository you want to contribute to
```bash theme={null}
git checkout -b feature/your-improvement
```
Implement your improvements following the project's coding standards
Test your changes in multiple environments
Submit a PR with clear description of changes and testing performed
***
## 👥 Credits
GhostPack tools are developed and maintained by:
**Primary Authors:**
* [@harmj0y](https://twitter.com/harmj0y) (Will Schroeder)
* [@tifkin\_](https://twitter.com/tifkin_) (Lee Christensen)
**Organization:**
* [SpecterOps](https://specterops.io) - Offensive security research and operations
**Community:**
* Numerous contributors from the security community
* Issue reporters and testers
* Documentation contributors
***
## 📝 License
Most GhostPack tools are released under the BSD 3-Clause License. Check individual repositories for specific licensing information.
***
For the latest updates, new tool releases, and announcements, follow the [GhostPack GitHub organization](https://github.com/GhostPack) and [@harmj0y on Twitter](https://twitter.com/harmj0y).