darklink
A tool to quickly transfer a file to or from a compromised system during security assessments.
Features
Unlike python3 -m http.server darklink will:
- Generate the command for you to copy and paste on the compromised host.
- Expose only the specific file you want to transfer, rather than the entire working directory.
- Automatically fetch and transfer the latest versions of commonly used tools (e.g., winPEAS, linPEAS, mimikatz).
- Allow you to exfiltrate files from the compromised host to your machine.
Install
pip3 install darklink
Usage
-
Transfering a file
darklink drop --file ./exploits/gameoverlay.sh
-
Transfering one of the provided tools
darklink drop --tool sharphound darklink drop --tool linpeas darklink drop --tool chisel --platform linux darklink drop --tool chisel --platform windows --arch 386
-
Exfiltration
darklink exfil --file 20240302144505_BloodHound.zip
Provided tools
| Tool | Description |
|---|---|
| chisel | Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. |
| LaZagne | The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. |
| LinEnum | Scripted Local Linux Enumeration & Privilege Escalation Checks. |
| mimikatz | A little tool to play with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory |
| winPEAS | Windows local Privilege Escalation Awesome Script. |
| linPEAS | Linux local Privilege Escalation Awesome Script. |
| PrivescCheck | Privilege Escalation Enumeration Script for Windows. |
| pspy | Monitor linux processes without root permissions. |
| RunasCs | RunasCs is an utility to run specific processes with different permissions than the user's current logon provides using explicit credentials. |
| SharpHound | C# Data Collector for BloodHound. |
| AccessChk | AccessChk is a command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more. |
| Procdump | This command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. |
| PsExec | Execute processes on remote systems. |
1 maintainer
Release files for darklink 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| darklink-1.0.0.tar.gz | 18.6 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| darklink-1.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 42.0 kB
Release files / darklink-1.0.0.tar.gz
| Download URL | darklink-1.0.0.tar.gz |
|---|---|
| Size | 18.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4965fe0856a0380097b562c750d2308385909fada604bc29790d02263ba6f939
|
|
BLAKE2b-256 checksum How to use checksums |
b02e70667131d8fb20b3d028bca8a5c5a523ba60f7374d045ebc002c648da7dc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/1.8.2 CPython/3.11.7 Linux/6.6.19-1-MANJARO
|
Release files / darklink-1.0.0-py3-none-any.whl
| Download URL | darklink-1.0.0-py3-none-any.whl |
|---|---|
| Size | 23.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0b81b6319cae59381e737de29f5eae84483af2b64d50e05d56b626bceb3cfc6a
|
|
BLAKE2b-256 checksum How to use checksums |
af0c4c58f97fbba600ce025daea6b6c98bb206c8048fd32c234e5c3cae63d960
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/1.8.2 CPython/3.11.7 Linux/6.6.19-1-MANJARO
|
