SharpCollection

Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

Is your favorite tool missing? Feel free to open an issue or DM me on X @Flangvik Please note that Cobalt Strike's execute-assembly only accepts binaries compiled with the "Any CPU" configuration.

OpSec

Should I blindly deploy any of these binaries during real-life engagements? F*ck no, always look through anything that you deploy on a client machine or network. Eg https://github.com/dnSpyEx/dnSpy Deploying anything blindly from this repo should be reserved for Lab environments, VM's , HackTheBox, detection mapping, and so forth.

Azure DevOps?

Each night at 03:00 AM, the Azure DevOps pipeline checks for new commits to all repositories master branch. Branches with changes will be automatically fetched and compiled with different framework targets as well as architectures, before being pushed to this repo.

The pipeline can be found here: https://dev.azure.com/FlangvikDev/SharpRelease

Available builds

Legend: :heavy_check_mark: = Actively built | :x: = Not built | :warning: = Pipeline exists but all steps disabled

Tools marked with * have special notes — see footnotes below the table.

Some tools target specific framework versions: Certify, KrbRelay, KrbRelayUp, ShadowSpray target v4.7.2. ADCollector targets v4.6.1.

Tools \ .NET Framework	NET 4.0	NET 4.5	NET 4.7
ADCollector ¹	:x:	:x:	:heavy_check_mark:
ADCSPwn	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
ADFSDump	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
ADSearch	:x:	:x:	:heavy_check_mark:
AtYourService ²	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
BadAssMacros	:x:	:heavy_check_mark:	:heavy_check_mark:
BetterSafetyKatz	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
Certify ³	:x:	:x:	:heavy_check_mark:
CheeseTools ⁴	:x:	:x:	:heavy_check_mark:
DeployPrinterNightmare	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
EDD	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
Evasor ²	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
Farmer	:x:	:x:	:heavy_check_mark:
ForgeCert	:x:	:heavy_check_mark:	:heavy_check_mark:
GMSAPasswordReader	:x:	:x:	:heavy_check_mark:
Group3r	:x:	:heavy_check_mark:	:heavy_check_mark:
Grouper2	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
Internal-Monologue	:heavy_check_mark:	:heavy_check_mark:	:heavy_check_mark:
InveighZero	:warning:	:warning:	:warning:
KrbRelay ³

Footnotes

1. ADCollector — Targets .NET Framework v4.6.1 specifically (mapped to NET 4.7 column)
2. AtYourService, Evasor — No AnyCPU builds, only x64/x86 platforms
3. Certify, KrbRelay, KrbRelayUp, ShadowSpray — Target .NET Framework v4.7.2 specifically
4. CheeseTools — Pipeline exists but has never had a successful build
5. SharpBlock — Only builds NET 4.0 and NET 4.5; NET 4.7 steps are disabled. No AnyCPU builds (x64/x86 only)
6. SharpDoor — Only publishes x64 binaries (compiled via PowerShell script)
7. Scout — The original repository has been removed. Binaries included are outdated and no longer maintained
8. SharpSystemTriggers — Pipeline is paused. Existing binaries may be outdated

InveighZero :warning: — Pipeline has all build steps disabled and is non-functional. Existing binaries in the repo are from previous builds.

Sources / Credits

Links for all these amazing tools are below :)

• ADCollector - C# tool to quickly extract valuable information from the Active Directory environment @dev-2null
• ADCSPwn - C# tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service. @bats3c
• ADSearch - C# tool to help query AD via the LDAP protocol @tomcarver16 (Only NET 4.7)
• ADFSDump - A C# tool to dump all sorts of goodies from AD FS. @FireEye
• AtYourService - C# .NET Assembly for Service Enumeration @mitchmoser
• BadAssMacros - C# based automated malicous macro generator @Flangvik
• BetterSafetyKatz - Fork of SafetyKatz dynamically fetches the latest Mimikatz, runtime patching signatures and PE loads Mimikatz into memory. @Flangvik
• Certify - C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS). @harmj0y @tifkin_
• CheeseTools - Self-developed tools for lateral movement/code execution @klezVirus
• EDD - Enumerate Domain Data is designed to be similar to PowerView but in .NET @FortyNorthSecurity
• Evasor - A tool to be used in post-exploitation phase for assessing and evading AV @CyberArk
• Farmer - Coll