Primary Categories: [[BianLian]] Links: [[BianLian Articles]] / [[BianLian CVE's]] / [[BianLian Ransom Note]] / [[BianLian TTP's]] # [[BianLian Tools]] ## Discovery - Advanced IP Scanner - Advanced IP Scanner is used to discover all connected devices on a local network, providing details like IP addresses, MAC addresses, and device names, enabling network administrators to manage and monitor their network. - https://www.advanced-ip-scanner.com/ - PingCastle - PingCastle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework. It does not aim at a perfect evaluation but rather as an efficiency compromise. - https://github.com/netwrix/pingcastle - SharpShares - Quick and dirty binary to list network share information from all machines in the current domain and if they're readable. Can also translate all computer names to ip addresses. - https://github.com/djhohnstein/SharpShares - SoftPerfect NetScan - This fast, highly configurable IPv4/IPv6 scanner can streamline many of your network support procedures. Its well-designed interface, light weight and portability coupled with an extensive range of options and advanced features make SoftPerfect Network Scanner an invaluable tool, whether you are a professional system administrator, someone providing occasional network maintenance, or a general user interested in computer security. - https://www.softperfect.com/products/networkscanner/ ## RMM-Tools - AnyDesk - AnyDesk is used for remote desktop access, allowing users to control one computer from another device as if they were physically there. - https://anydesk.com/en - AmmyyAdmin - Ammyy admin is a tool for remote computer administration over the internet. It allows users to connect to another device and control it as if they were physically present. It's often used for tech support, server management, or working remotely. - https://www.ammyy.com/en/ - Atera - Atera Networks (also known simply as Atera) is an IT management software that integrates functionalities such as remote monitoring and management (RMM), patch management, and operational automation alongside operational aspects like help desk, and ticketing systems. - https://www.atera.com/ - ScreenConnect - ScreenConnect is a software used for remote support, remote access, and remote meetings. It allows users, typically IT professionals, to remotely control computers, servers, and mobile devices to troubleshoot issues, provide technical assistance, or perform unattended maintenance. - https://www.screenconnect.com/ - Splashtop - Splashtop is used for remote access to a computer or device, allowing users to view and control it from another device, anywhere with an internet connection. It is used by individuals for remote work and by IT professionals for remote support, troubleshooting, and device management. - https://www.splashtop.com/ - TeamViewer - TeamViewer is a remote access and support software that allows users to remotely control and maintain computers and other devices from anywhere. - https://www.teamviewer.com/en-us/ ## Credential Theft - RDP Recognizer - RDP scanning tool that is mainly focussed on detecting NLA automatically leaking usernames. - https://github.com/mverschu/rdp-scanner/ ## Offsec - Impacket - Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks. - https://github.com/fortra/impacket ## LOLBAS - PsExec - PsExec is a lightweight telnet replacement that lets users execute processes on other systems (complete with full interactivity for console applications) without having to manually install client software. PsExec's uses include launching interactive command-prompts on remote systems and remote-enabling tools such as IpConfig that otherwise do not have the ability to show information about remote systems. - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec ## Exfiltration - MEGA - MEGA is a secure, user-controlled end-to-end encrypted cloud storage and communications service with generous free storage space. - https://mega.io/ - Rclone - Rclone is a command-line tool used for managing files on cloud storage, allowing users to copy, sync, and transfer files between various cloud providers and local systems. - https://rclone.org/