AS2Go
2026.11.13.1258
AS2Go is an acronym for Attack Scenario to Go.
Minimum PowerShell version
7.4
Installation Options
Owners
Copyright
License: MIT | Copyright (c) 2026 Holger Zimmermann
Package Details
Author(s)
- Holger Zimmermann | as2go@mrhozi.com
Tags
ActiveDirectory ADCS Killchain RedTeam Offense AttackSimulation AdversaryEmulation PurpleTeam BlueTeam DefensiveSecurity
Functions
Get-PSCDump Get-PSCCAAdministrator Get-PSCCertificateManager Get-PSCEnrollmentAgent Get-PSCOfficerRight Get-PSCEditFlag Enable-PSCEditFlag Disable-PSCEditFlag Get-PSCInterfaceFlag Enable-PSCInterfaceFlag Disable-PSCInterfaceFlag Get-PSCDisableExtensionList Get-PSCAuditFilter
Dependencies
This module has no dependencies.
Release Notes
2026.11.13.1258
- Requires PowerShell 7.4 or later.
- Added -SafeMode to restrict selected actions during guided lab demos.
- Added timestamped JSON backups of direct privileged group memberships and additive restore. Phase 12 can refresh the backup before a purge.
- Expanded lab readiness checks for domain controller access, external tools, DNS zone transfers, and AD CS.
- Updated the Phase 07 privilege escalation walkthrough and added Pass-The-Ticket and Overpass-the-Hash techniques.
- Improved handling Golden Ticket attacks.
- Added option to create a set of demo principals
2026.5.21.957
- Added Golden Ticket Attack to Phase 12 Domain Persistence.
2026.5.18.1200
- Added GPO Template modification to Phase 12 Domain Persistence.
v2026.5.7.1034
- Privileged Escalation via ESC1 added.
- Minor bug fixes and performance improvements.
2026.3.17.1034
- Initial release of AS2Go on PS Gallery.
FileList
- AS2Go.nuspec
- AS2Go.json
- AS2Go.psd1
- AS2Go.psm1
- Config\UserInterface.json
- LICENSE
- LabSetup\AS2Go-Admin.jpg
- LabSetup\AS2Go-DemoUsers.csv
- LabSetup\AS2Go-HelpDesk.jpg
- LabSetup\AS2Go-Victim.jpg
- LabSetup\AdminPC\Add-RandomUser.ps1
- LabSetup\AdminPC\Create-DA-Tickets.ps1
- LabSetup\AdminPC\Create-Shortcut.ps1
- LabSetup\AdminPC\DC-BackGround.jpg
- LabSetup\AdminPC\DEV-Background.jpg
- LabSetup\AdminPC\PAW-Background.jpg
- LabSetup\AdminPC\VI-DesktopBackground.jpg
- LabSetup\AdminPC\simulate-admin-activity.cmd
- LabSetup\Encryption\preview.html
- LabSetup\ShareContent\daily-work.txt
- LabSetup\thumbnailPhotos\AS2Go-admin.jpg
- LabSetup\thumbnailPhotos\AS2Go-helpdesk.jpg
- LabSetup\thumbnailPhotos\AS2Go-victim.jpg
- LabSetup\thumbnailPhotos\AS2Go_BD-User.jpg
- Modules\ADCSGoat\ADCSGoat.psd1
- Modules\ADCSGoat\ADCSGoat.psm1
- Modules\ADCSGoat\LICENSE
- Modules\ADCSGoat\Private\Template\ESC1.json
- Modules\ADCSGoat\Private\Template\ESC1.ps1
- Modules\ADCSGoat\Private\Template\ESC1.xml
- Modules\ADCSGoat\Private\Template\ESC2.json
- Modules\ADCSGoat\Private\Template\ESC2.ps1
- Modules\ADCSGoat\Private\Template\ESC2.xml
- Modules\ADCSGoat\Private\Template\ESC3c1.json
- Modules\ADCSGoat\Private\Template\ESC3c1.ps1
- Modules\ADCSGoat\Private\Template\ESC3c1.xml
- Modules\ADCSGoat\Private\Template\ESC3c2.json
- Modules\ADCSGoat\Private\Template\ESC3c2.ps1
- Modules\ADCSGoat\Private\Template\ESC3c2.xml
- Modules\ADCSGoat\Private\Template\ESC4.json
- Modules\ADCSGoat\Private\Template\ESC4.ps1
- Modules\ADCSGoat\Private\Template\ESC4.xml
- Modules\ADCSGoat\Private\Template\ESC9.json
- Modules\ADCSGoat\Private\Template\ESC9.ps1
- Modules\ADCSGoat\Private\Template\ESC9.xml
- Modules\ADCSGoat\Public\Deploy-AGInfrastructure.ps1
- Modules\ADCSGoat\Public\Find-AGEnrollmentService.ps1
- Modules\ADCSGoat\Public\Install-ADCSGoat.ps1
- Modules\ADCSGoat\Public\New-AGBlankTemplateObject.ps1
- Modules\ADCSGoat\Public\Publish-AGCertficateTemplate.ps1
- Modules\ADCSGoat\Public\Set-AGEnrollmentServiceFullName.ps1
- Modules\ADCSGoat\Public\Set-AGTemplateAce.ps1
- Modules\ADCSGoat\Public\Set-AGTemplateProperty.ps1
- Modules\ADCSGoat\Public\Uninstall-ADCSGoat.ps1
- Modules\ADCSGoat\en-US\about_Build-LocksmithLab.help.txt
- Modules\PSCertutil\PSCertutil.psd1
- Modules\PSCertutil\PSCertutil.psm1
- Modules\PSCertutil\README.md
- Modules\PSCertutil\Research\Convert-EnrollmentAgentBlobToByteArray.ps1
- Modules\PSCertutil\Research\EditFlags.txt
- Modules\PSCertutil\Research\EnrollmentAgentBlobFromCertutil.txt
- Modules\PSCertutil\Research\EnrollmentAgentRights.xml
- Modules\PSCertutil\Research\EnrollmentAgentRightsFromCertUtil.xml
- Modules\PSCertutil\Research\Get-EnrollmentAgentRights.ps1
- Modules\PSCertutil\Research\Get-TemplateInfo.ps1
- Modules\PSCertutil\Research\InterfaceFlags.txt
- Modules\PSCertutil\Research\UnparsedEnrollmentAgentOutputFromCertutil.xml
- Modules\PSCertutil\certutil.crescendo.config.json
- Modules\PSCertutil\parseAuditFilter.ps1
- Modules\PSCertutil\parseCAAdministrator.ps1
- Modules\PSCertutil\parseCertificateManager.ps1
- Modules\PSCertutil\parseDisableExtensionList.ps1
- Modules\PSCertutil\parseEditFlag.ps1
- Modules\PSCertutil\parseEnrollmentAgent.ps1
- Modules\PSCertutil\parseInterfaceFlag.ps1
- Modules\PSCertutil\parseModifyFlag.ps1
- Modules\PSCertutil\parseOfficerRight.ps1
- Phases\AS2Go-Icon-Cyan-Red.png
- Phases\AS2Go_BD-User.jpg
- Phases\ESC-PtT.png
- Phases\ESC_PtT.html
- Phases\KillChain.png
- Phases\phase_00.html
- Phases\phase_00.png
- Phases\phase_020.html
- Phases\phase_04.html
- Phases\phase_04.png
- Phases\phase_05.html
- Phases\phase_05.png
- Phases\phase_06.html
- Phases\phase_06.png
- Phases\phase_07.html
- Phases\phase_07.png
- Phases\phase_07_Attack-Compatibility-Reference.html
- Phases\phase_07_ESC1-Troubleshooting.html
- Phases\phase_08.html
- Phases\phase_08.png
- Phases\phase_09.html
- Phases\phase_09.png
- Phases\phase_10.html
- Phases\phase_10.png
- Phases\phase_11.html
- Phases\phase_11.png
- Phases\phase_12.html
- Phases\phase_12.png
- Phases\phase_poi.html
- Phases\phase_test.html
- Private\1-FunctionTemplate.ps1
- Private\Add-ADCSForAS2Go.ps1
- Private\Add-ASConfig.ps1
- Private\Add-GPOMemberToBuiltinGroups.ps1
- Private\Add-GPOScheduleTask.ps1
- Private\Add-GPOUserRightAssignments.ps1
- Private\Add-GroupElementToFileGroupsXml.ps1
- Private\Add-RandomUsersToAccountOperators.ps1
- Private\Add-TaskElementToFileScheduleTaskXml.ps1
- Private\Add-TrusteeToFileGroupsXml.ps1
- Private\Add-VictimAccount.ps1
- Private\Clear-ExfiltrationFolder.ps1
- Private\Convert-FromDNToCN.ps1
- Private\ConvertFrom-CredentialDump.ps1
- Private\ConvertFrom-MemoryDump.ps1
- Private\Disable-ADOUInheritance.ps1
- Private\Export-DPAPIBackupKey.ps1
- Private\Get-ADCSCertificateTemplates.ps1
- Private\Get-ADCSComponents.ps1
- Private\Get-ADCSEnrollmentServices.ps1
- Private\Get-ADCSEnterpriseCA.ps1
- Private\Get-ADGroupSamAccountNameBasedOnRID.ps1
- Private\Get-ADUserDetails.ps1
- Private\Get-ADUserNameBasedOnRID.ps1
- Private\Get-AS2GoGroups.ps1
- Private\Get-AS2GoSettings.ps1
- Private\Get-AS2GoTokenGroupMembership.ps1
- Private\Get-ASConfig.ps1
- Private\Get-AdminWithSPN.ps1
- Private\Get-Answer.ps1
- Private\Get-BestDomainController.ps1
- Private\Get-BreakGlassAccount.ps1
- Private\Get-CachedKerberosTicketsClient.ps1
- Private\Get-ComputerInformation.ps1
- Private\Get-CurrentADUserInfo.ps1
- Private\Get-DCLiveMetrics.ps1
- Private\Get-DemoAccounts.ps1
- Private\Get-DirContent.ps1
- Private\Get-DomainPWDetails.ps1
- Private\Get-DomainType.ps1
- Private\Get-DomainsInForest.ps1
- Private\Get-FileVersion.ps1
- Private\Get-FolderPath.ps1
- Private\Get-ForestInfo.ps1
- Private\Get-FunctionCallParameters.ps1
- Private\Get-FunctionName.ps1
- Private\Get-GPOLinkedOnDomain.ps1
- Private\Get-GPOSettings.ps1
- Private\Get-Honeytoken.ps1
- Private\Get-KListTickets.ps1
- Private\Get-KirbiBestFiles.ps1
- Private\Get-KirbiTicketInfo.ps1
- Private\Get-KirbiUniqueAccounts.ps1
- Private\Get-KirbiUniqueInfo.ps1
- Private\Get-LocalComputerInformation.ps1
- Private\Get-LogonServerFQDN.ps1
- Private\Get-LsassProtectionStatus.ps1
- Private\Get-NumberOfDCs.ps1
- Private\Get-OSBuild.ps1
- Private\Get-OSVersion.ps1
- Private\Get-PrivilegeGroupMember.ps1
- Private\Get-RandomPassword.ps1
- Private\Get-RiskyEnrolledTemplates.ps1
- Private\Get-RunTime.ps1
- Private\Get-SYSVOLGPOPerms.ps1
- Private\Get-SessionsOnDC.ps1
- Private\Get-TargetGPO.ps1
- Private\Get-TieringAssets.ps1
- Private\Get-UPNSuffix.ps1
- Private\Get-VulnerableCertificateTemplate.ps1
- Private\Initialize-ADOUPath.ps1
- Private\Initialize-AS2GoAssets.ps1
- Private\Initialize-AS2GoDirectory.ps1
- Private\Initialize-AS2GoTools.ps1
- Private\Initialize-ConsoleColors.ps1
- Private\Install-ADCSCertificateAuthority.ps1
- Private\Install-ADCSEnrollementServices.ps1
- Private\Invoke-ADCSSetup.ps1
- Private\Invoke-BackUpShare.ps1
- Private\Invoke-BackdoorUserCreation.ps1
- Private\Invoke-DPAPIBackupKeyExport.ps1
- Private\Invoke-DemoAccounts.ps1
- Private\Invoke-Encryption.ps1
- Private\Invoke-GPTManipulation.ps1
- Private\Invoke-GoldenTicketAttack.ps1
- Private\Invoke-GroupManipulation.ps1
- Private\Invoke-KerberoastingAttack.ps1
- Private\Invoke-MDITriggers.ps1
- Private\Invoke-OverPassTheHashAttack.ps1
- Private\Invoke-PassTheTicketAttack.ps1
- Private\Invoke-PriviledgeEscalationViaMemoryAccess.ps1
- Private\Invoke-PrivilegeEscalationViaESC1.ps1
- Private\Invoke-PrivilegeEscalationViaLocalSystem.ps1
- Private\Invoke-PrivilegeGroupPurge.ps1
- Private\Invoke-Reconnaissance.ps1
- Private\Invoke-ReconnaissanceExtended.ps1
- Private\Invoke-Shutdown.ps1
- Private\Invoke-UserAccountDisruption.ps1
- Private\Invoke-VerifyConfiguration.ps1
- Private\Measure-FunctionRuntime.ps1
- Private\New-BackUpShare.ps1
- Private\New-DemoAccount.ps1
- Private\New-GPCExtension.ps1
- Private\New-HelpLabel.ps1
- Private\New-HelpOptions.ps1
- Private\New-HoneytokenActivity.ps1
- Private\New-PasswordSprayAttack.ps1
- Private\New-PrivilegeEscalationRecommendation.ps1
- Private\New-RandomPassword.ps1
- Private\New-TargetBase.ps1
- Private\Remove-AS2GoGroupMembers.ps1
- Private\Request-PfxWithCertify.ps1
- Private\Request-TGTWithRubeus.ps1
- Private\Search-ADGroupMemberShip.ps1
- Private\Search-ProcessForAS2GoUsers.ps1
- Private\Select-ADObject.ps1
- Private\Set-AS2GoDnsZoneConfiguration.ps1
- Private\Set-ASConfig.ps1
- Private\Set-AlternativeAccount.ps1
- Private\Set-AttackScope.ps1
- Private\Set-BestDomainController.ps1
- Private\Set-BreakGlassAccount.ps1
- Private\Set-DenyPermission.ps1
- Private\Set-GPCMachineExtensionNames.ps1
- Private\Set-Honeytoken.ps1
- Private\Set-NewBackgroundColor.ps1
- Private\Set-NewColorSchema.ps1
- Private\Set-SecureAccessWorkstation.ps1
- Private\Set-TextMarker.ps1
- Private\Set-UPNSuffix.ps1
- Private\Set-UseLogonCredential.ps1
- Private\Show-AS2GoPreview.ps1
- Private\Show-CurrentPhase.ps1
- Private\Show-DecisionPrompt.ps1
- Private\Show-Disclaimer.ps1
- Private\Show-ForestOverview.ps1
- Private\Show-PiskelFile.ps1
- Private\Start-AS2GoDemoPopup.ps1
- Private\Start-Encryption.ps1
- Private\Start-Kerberoasting.ps1
- Private\Start-PasswordSprayAttack.ps1
- Private\Start-UserAccountDisruption.ps1
- Private\Stop-AS2GoDemo.ps1
- Private\Test-ADLogon.ps1
- Private\Test-AccessDirectory.ps1
- Private\Test-AccessToOneDCPerDomain.ps1
- Private\Test-LocalAdministrator.ps1
- Private\Test-PoSHModuleAvailability.ps1
- Private\Undo-UserManipulation.ps1
- Private\Update-WindowTitle.ps1
- Private\Wait-AS2GoUserInput.ps1
- Private\Write-AS2GoOutput.ps1
- Private\Write-Highlight.ps1
- Private\Write-Log.ps1
- Public\Export-ADPrivilegedGroupDirectMember.ps1
- Public\Find-ADForestUser.ps1
- Public\Import-ADPrivilegedGroupDirectMember.ps1
- Public\Initialize-AS2GoLab.ps1
- Public\Invoke-Phase04BruteForceAttack.ps1
- Public\Invoke-Phase05InitialAccess.ps1
- Public\Invoke-Phase06Reconnaissance.ps1
- Public\Invoke-Phase07PrivilegeEscalation.ps1
- Public\Invoke-Phase09ReconnaissancePriviledged.ps1
- Public\Invoke-Phase10AccessSensitiveData.ps1
- Public\Invoke-Phase11ExfiltrateSensitiveData.ps1
- Public\Invoke-Phase12DomainCompromisePersistence.ps1
- Public\New-As2GoDemoPrincipal.ps1
- Public\Start-AS2GoDemo.ps1
- README.md
- SECURITY.md
- Setup.md
- Tools\AS2Go-Tools_v3.zip
- Tools\README.md
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2026.11.13.1258 (current version) | 8 | 11/13/2026 |
| 2026.5.21.1342 | 152 | 5/21/2026 |
| 2026.5.7.1034 | 33 | 5/7/2026 |
| 2026.5.6.502 | 27 | 5/6/2026 |
| 2026.5.5.896 | 6 | 5/5/2026 |
| 2026.5.5.532 | 23 | 5/5/2026 |
| 2026.3.17.1034 | 24 | 3/23/2026 |