#!/bin/bash
# Phase 3 — Active Directory & Windows
source "$(dirname "$0")/lib.sh"

phase_header "PHASE 3 — Active Directory & Windows"

section "Impacket Suite"
chk "impacket-psexec"         impacket-psexec
chk "impacket-smbexec"        impacket-smbexec
chk "impacket-wmiexec"        impacket-wmiexec
chk "impacket-secretsdump"    impacket-secretsdump
chk "impacket-GetUserSPNs"    impacket-GetUserSPNs
chk "impacket-GetNPUsers"     impacket-GetNPUsers
chk "impacket-ntlmrelayx"     impacket-ntlmrelayx
chk "impacket-rpcdump"        impacket-rpcdump
chk "impacket-samrdump"       impacket-samrdump
chk "impacket-lookupsid"      impacket-lookupsid
chk "impacket-ticketer"       impacket-ticketer
chk "impacket-getST"          impacket-getST

section "Core AD Tools"
chk "certipy"                 certipy
chk "evil-winrm"              evil-winrm
chk "bloodhound-python"       bloodhound-python
chk "kerbrute"                kerbrute
chk "netexec"                 netexec
chk "crackmapexec"            crackmapexec
chk "ldeep"                   ldeep
chk "windapsearch"            windapsearch

section "Enumeration"
chk "ldapdomaindump"          ldapdomaindump
chk "enum4linux"              enum4linux
chk "enum4linux-ng"           enum4linux-ng
chk "nbtscan"                 nbtscan
chk "smbmap"                  smbmap
chk "smbclient"               smbclient

section "Coercion & Relay"
chk "responder"               responder
chk "mitm6"                   mitm6
chk_py "coercer"              coercer
chk_dir "PetitPotam"          /opt/PetitPotam
chk_dir "krbrelayx"           /opt/krbrelayx

section "ADCS Attacks"
chk_dir "PKINITtools"         /opt/PKINITtools
chk "certipy"                 certipy

section "Kerberos Attacks"
chk_dir "KrbRelayUp"          /opt/KrbRelayUp
chk_py "pywhisker"            pywhisker

section "CVE Exploits"
chk_dir "Zerologon"           /opt/CVE-2020-1472
chk_dir "PrintNightmare"      /opt/PrintNightmare
chk_dir "NoPac"               /opt/noPac

section "Persistence"
chk_dir "ADFSpoof (SAML)"     /opt/ADFSpoof
chk "bloodyAD"                bloodyAD
chk_dir "pyGPOAbuse"          /opt/pyGPOAbuse

section "Credential Hunting"
chk_py "pypykatz"             pypykatz
chk_dir "DonPAPI"             /opt/DonPAPI
chk_py "pyrdp"                pyrdp

section "Evasion (AD)"
chk_dir "SysWhispers3"        /opt/SysWhispers3
chk_dir "ScareCrow"           /opt/ScareCrow
chk_dir "KrbRelayUp"          /opt/KrbRelayUp

section "BloodHound"
chk "BloodHound.py"           bloodhound-python
chk "bloodhound-python"       bloodhound-python

section "Post-Auth Lateral"
chk_dir "DeathStar"           /opt/DeathStar

section "Exchange / SharePoint"
chk "roadrecon"               roadrecon
chk_py "roadtools"            roadtools

phase_summary
