NorkNork

KO | EN

gitlite — search

#javascript #python #react #golang #android #deep-learning #docker #java #windows #awesome #kubernetes #vue #pytorch #open-source

(★ 118)

Powershell Empire Persistence finder

File Explorer

Download Latest Version (.zip)

- NorkNork.zip
norknork.png
norknork.py
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# NorkNork - Tool for identifying Empire persistence payloads
https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/
## ABOUT:
This script was designed to identify Powershell Empire persistence payloads on Windows systems.  
It currently supports checks for these persistence methods:
- Scheduled Tasks
- Auto-run
- WMI subscriptions
- Security Support provider
- Ease of Access Center backdoors
- Machine account password disable

## INSTALL:

You can run this script with python 2.7 or by downloading the pyinstaller exe.  Run the binary or the script in a powershell window.

## USAGE:

### Running the python script
```
PS C:\Users\>python norknork.py
```
### Running the binary
```
PS C:\Users\> .\norknork.exe
```
### Save the data into a text file
```
PS C:\Users\> .\norknork.exe > results.txt

```
![alt tag](https://github.com/n00py/NorkNork/blob/master/norknork.png)
###FAQ:

Q: Why didn't you just create this in powershell?

A: I was too lazy to learn powershell.

Q: Will this find all persistence methods?

A: No, only those in Powershell Emprire and only those that perist through reboots.

NorkNork

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

NorkNork

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README