Primary Categories: [[Akira]] Links: [[Akira Articles]] / [[Akira CVE's]] / [[Akira Ransom Note]] / [[Akira TTP's]] # [[Akira Tools]] ## Discovery - Advanced IP Scanner - Advanced IP Scanner is used to discover all connected devices on a local network, providing details like IP addresses, MAC addresses, and device names, enabling network administrators to manage and monitor their network. - https://www.advanced-ip-scanner.com/ - Bloodhound - BloodHound is an open-source tool for cybersecurity that maps complex relationships within an Active Directory (AD) environment to identify potential attack paths. - https://github.com/SpecterOps/BloodHound - ldapdomaindump - In an Active Directory domain, a lot of interesting information can be retrieved via LDAP by any authenticated user (or machine). This makes LDAP an interesting protocol for gathering information in the recon phase of a pentest of an internal network. A problem is that data from LDAP often is not available in an easy to read format. - https://github.com/dirkjanm/ldapdomaindump - Masscan - Masscan is an extremely high-speed port scanner used by cybersecurity professionals for large-scale network reconnaissance, security auditing, and penetration testing. - https://github.com/robertdavidgraham/masscan - ReconFTW - ReconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. - https://github.com/six2dez/reconftw - SharpHound - SharpHound has established itself as the backbone of AD discovery, functioning almost as an integrated feature of BloodHound. It collects AD data through three primary Windows data gathering methods: LDAP(s) and SMB with Distributed Computing Environment / Remote Procedure Calls (DCERPC). - https://github.com/SpecterOps/SharpHound - SharpShares - Quick and dirty binary to list network share information from all machines in the current domain and if they're readable. Can also translate all computer names to ip addresses. - https://github.com/djhohnstein/SharpShares - SoftPerfect NetScan - This fast, highly configurable IPv4/IPv6 scanner can streamline many of your network support procedures. Its well-designed interface, light weight and portability coupled with an extensive range of options and advanced features make SoftPerfect Network Scanner an invaluable tool, whether you are a professional system administrator, someone providing occasional network maintenance, or a general user interested in computer security. - https://www.softperfect.com/products/networkscanner/ ## RMM Tools - AnyDesk - AnyDesk is used for remote desktop access, allowing users to control one computer from another device as if they were physically there. - https://anydesk.com/en - MeshAgent - The MeshCentral Agent is the software that runs on remote devices and connects to the MeshCentral server to allow for remote device management. This agent is compiled for Windows, many different Linux distributions, macOS and FreeBSD. - https://github.com/Ylianst/MeshAgent - MobaXterm - MobaXterm is an application that provides X-Server capability for the Microsoft Windows operating system. This allows applications running in the Unix/Linux environment to display graphical user interfaces on the Microsoft Windows desktop. - https://mobaxterm.mobatek.net/download.html - Radmin - Radmin is remote access software with built-in cybersecurity features, like AES 256-bit encryption, for securing remote connections. However, it's also a potential security risk if misused by attackers to gain unauthorized access. - https://www.radmin.com/download/ - RustDesk - RustDesk is an open-source remote desktop application that functions as an alternative to commercial software like TeamViewer and AnyDesk. - https://rustdesk.com/ - TeamViewer - TeamViewer is a remote access and support software that allows users to remotely control and maintain computers and other devices from anywhere. - https://www.teamviewer.com/en-us/ ## Defense Evasion - PowerTool - A Windows utility designed to improve speed, remove bloatware, protect privacy, and eliminate data collection, among other things. - https://learn.microsoft.com/en-us/windows/powertoys/ - Zemana Anti-Rootkit driver - Zemana AntiMalware was a software application created to identify and remove malware on Windows and Android devices. It operated primarily as a supplemental scanner alongside existing antivirus programs. - https://zemana.com/us/antimalware.html ## Credential Theft - DonPAPI - DonPAPI automates secrets dump remotely on multiple Windows computers, with defense evasion in mind. - https://github.com/login-securite/DonPAPI - LaZagne - The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. - https://github.com/AlessandroZ/LaZagne - Mimikatz - Mimikatz is a tool that is commonly used by hackers and security professionals to extract sensitive information, such as passwords and credentials, from a system’s memory. It is typically used to gain unauthorized access to networks, systems, or applications or to perform other malicious activities, such as privilege escalation or lateral movement within a network. - https://github.com/ParrotSec/mimikatz ## OffSec - CrackMapExec - A post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks. - https://github.com/byt3bl33d3r/CrackMapExec - Impacket - Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks. - https://github.com/fortra/impacket - NetExec - NetExec is a network service exploitation tool that helps automate assessing the security of _large_ networks. - https://github.com/Pennyw0rth/NetExec ## Networking - Cloudflared - Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins. This daemon sits between Cloudflare network and your origin (e.g. a webserver). - https://github.com/cloudflare/cloudflared - OpenSSH - OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. - https://www.openssh.org/ - Ngrok - Ngrok is used to expose a local server to the internet, making it accessible via a public URL. This is primarily used by developers to test local applications, share work-in-progress with others, and receive webhooks from services without deploying to a production environment. - https://ngrok.com/ ## Exfiltration - FileZilla - FileZilla is a free and open-source FTP (File Transfer Protocol) client used for transferring files between a local computer and a remote server. It is widely used for website publishing and maintenance to upload files, download them, and manage them directly on a web server. - https://filezilla-project.org/ - MEGA - MEGA is a secure, user-controlled end-to-end encrypted cloud storage and communications service with generous free storage space. - https://mega.io/ - Rclone - Rclone is a command-line tool used for managing files on cloud storage, allowing users to copy, sync, and transfer files between various cloud providers and local systems. - https://rclone.org/ - Temp[.]sh - Temp.sh is a website offering a temporary file upload service with a 2GB size limit and a 3-day expiration period. - https://temp.sh/ - WinSCP - WinSCP is a free and open-source file transfer client for Microsoft Windows that allows users to securely copy files between a local computer and a remote server. It supports multiple protocols, including SFTP, SCP, FTP, FTPS, WebDAV, and Amazon S3. - https://winscp.net/eng/index.php