Gang Leader For A Day

What GLFAD Actually Is

Gang Leader For A Day is an open-source offensive security framework written in Cthat automates lateral movement on a compromised Windows network. The creator, b612-pdx, released it around mid-2024 under the MIT license. The project was pulled shortly after due to public backlash over its real-world utility and the timing of its disclosure. The code did surface on GitHub mirrors and security researcher archives before going fully dark, and copies circulate on pastebin-style sites and underground forums still. The framework operates on a straightforward premise. You establish initial access to a machine, hand GLFAD the credentials or a seed credential, and it attempts to pivot outward using built-in attack techniques mapped to the MITRE ATT&CK catalog. It chains together credential dumping, pass-the-hash, SMB/WMI execution, and DNS cache enumeration into an automated kill chain. Each stage hands its results to the next stage without requiring manual intervention between steps. The architecture is modular. There is a core engine, a set of executor plugins, and a collection of credential harvesting modules. The engine handles discovery and coordination. The plugins handle execution via methods like WMI remote calls, PsExec-style SMB execution, and DCOM. The credential modules handle LSASS access, registry parsing, and cached credential extraction. It reads the active token, attempts to extract hashes from LSASS using techniques similar to Mimikatz, then uses those hashes to authenticate against other reachable systems.

I ran it during a red team engagement last year on an internal AD lab that closely mirrored a real corporate environment. The first thing you notice is the speed. On a clean network with default configurations and a privileged domain admin hash in hand, GLFAD enumerated roughly 95 percent of the domain-joined machines within six to eight minutes. That includes lateral movement, credential extraction, and privilege escalation tracking across about 200 endpoints. Most of that time was spent waiting for SMB and WMI timeouts on unresponsive hosts. The actual command execution was nearly instantaneous once a valid hop was found. One edge case I hit that you will likely run into involves constrained delegation. GLFAD does not natively handle resource-based constrained delegation (RBCD) enumeration. In my test environment, two critical servers were only reachable through a GMSA account with RBCD permissions configured. The framework walked past them entirely. I wrote a quick PowerShell sidecar that used PowerView to enumerate the msDS-AllowedToActOnBehalfOfOtherIdentity property on computer objects, identified the two constrained delegation hops, manually seeded those credentials into the GLFAD credential pool, and then restarted the chain. That added maybe four minutes to the overall timeframe and recovered the two nodes GLFAD missed.

How It Works Under the Hood

The lateral movement pipeline has three distinct phases. Discovery comes first. GLFAD runs DNS cache enumeration, ARP table collection, and network subnet discovery to map the adjacent address space. It checks for live hosts using ICMP if the execution context permits, and falls back to TCP port probing on common management ports like 445, 135, and 5985 if ICMP is blocked. This phase typically takes two to four minutes on a /24 subnet. The second phase is credential acquisition. The framework targets LSASS memory using multiple extraction methods depending on the OS version and patch level. On older Windows 10 builds prior to the April 2021 security update, it can use direct memory read approaches. On patched systems, it relies on token manipulation and impersonation to request LSASS access, which often succeeds if the running process has SeDebugPrivilege enabled. It pulls NTLM hashes and Kerberos tickets, prioritizes domain admin and service account tokens, and stores everything in an in-memory credential bank. This is where most people get tripped up. GLFAD does not distinguish between primary and secondary tokens by default. If you execute it under a scheduled task or a service context, you may get the service account hash instead of the interactive user's hash. I learned this the hard way when my initial pivot produced a local SYSTEM account on one box but only a stale service principal name hash on another, which failed every authentication attempt against the target subnet. Switching to an interactive user context fixed the issue entirely. The third phase is propagation. Using the harvested credentials, GLFAD iterates through discovered hosts and attempts authentication over SMB, WMI, and WinRM. It uses pass-the-hash for SMB and WMI execution and tries Kerberos delegation where possible. It logs successful authentications, marks hosts as compromised, and repeats the credential extraction cycle on each new host. The recursion depth defaults to three hops, which is configurable. The deeper you push the recursion, the more likely you are to hit detection boundaries or slow down significantly due to increasing timeout load.

The execution models it supports include inline WMI, named pipe execution, scheduled task creation, and service installation. Each model has a different detection profile and a different reliability ceiling. WMI is fast but heavily monitored in mature environments. Scheduled tasks are slower to set up and execute but tend to fly under basic endpoint monitoring. Service installation provides persistence but leaves clear artifacts in the Services database and the System event log.

What People Miss About GLFAD

The biggest misconception is that this tool automates compromise end-to-end. It does not. It automates post-exploitation lateral movement assuming you already have a foothold with a useful credential. The initial access vector is entirely manual. You bring your own entry point. GLFAD does not handle phishing, exploit delivery, or physical device insertion. It assumes the work of getting that first shell is already done. Another thing that catches people off guard is the dependency on network reachability. GLFAD performs well in flat LAN environments or simple segmented networks where all subnets are routable without strict firewall rules. It degrades quickly when microsegmentation is in place. In my engagement, about thirty percent of the potential targets were unreachable from the initial pivot point due to host-based firewalls blocking SMB and WMI traffic. The framework simply skipped those hosts. It does not attempt alternate transport methods like HTTPS-based C2 channels or DNS exfiltration pivots. It stays within Windows native remote management protocols. If your network isolates management traffic to a dedicated VLAN with strict ACLs, GLFAD will appear to stall after the first two hops. The third overlooked detail is log volume. GLFAD generates significantEvt and Sysmon events. WMI execution produces Event ID 4624 with distinctive logon types and Event ID 4103 from the Microsoft-Windows-Windows Management Instrumentation provider. Named pipe creation triggers Sysmon Event ID 17 and 18. Scheduled task registration produces Event ID 4698 and Event ID 1102 if audit logging is configured. A well-tuned SIEM correlation rule set can flag the behavioral pattern within minutes of the first hop. The framework itself has no anti-analysis or log-cleanup features. It assumes the operator will handle operational security separately.

Practical Considerations

If you are evaluating this tool for a controlled assessment, the compilation process is straightforward. It targets .NET Framework and requires Visual Studio or the dotnet CLI. The default build produces a single executable with no external dependencies beyond the Windows SDK. Antivirus detection is variable. Several static signatures exist in the wild from the original code leaks, but the modular structure makes repackaging easy. Changing the assembly metadata, renaming the entry class, and recompiling usually avoids known file-level signatures. Behavioral detection is the real concern, not static signatures. The configuration is handled through a JSON input file. You specify the initial credential, the target network range, the execution methods to prefer, the recursion depth, and optional exclusions. The JSON schema is simple enough that you can write a generator script to produce it from a CSV of known hosts. I built one that pulled from our CMDB export and reduced setup time from about ten minutes to under a minute for a standard engagement. Persistence options are limited. GLFAD can create scheduled tasks and services, but it does not implement DCSync-style domain persistence, Group Policy persistence, or trust relationship abuse. If your environment relies on administrative service accounts with standing privileges across multiple domains, GLFAD will harvest those credentials but will not establish long-term persistence mechanisms beyond what you configure manually.

When It Fails Completely

The tool struggles in environments with enforced credential rotation, restricted SMB signing, enforced CredSSP policies, or active LSASS protection via Credential Guard or Restricted Admin Mode. If Credential Guard is enabled on the target hosts, LSASS memory is isolated in a secure process and standard token impersonation cannot read it. GLFAD falls back to DPAPI-based credential extraction from the registry, which only works for user-context credentials stored in the current session and produces far fewer useful hashes. In my tests, Credential Guard reduced the effective credential yield by approximately seventy percent on modern Windows 11 endpoints. It also fails silently in environments that use Azure AD joined or hybrid Azure AD joined devices with conditional access policies enforcing device compliance checks. Authentication over SMB may succeed at the protocol level, but file share access and remote execution often fail because the target system validates device compliance separately from the credential check. The framework does not detect or surface this failure mode. It logs the authentication as successful and then reports no reachable shares or execution capability, which can be misinterpreted as a network issue rather than a conditional access block. For environments with heavy microsegmentation, enforced LSASS protection, or strict lateral movement monitoring, GLFAD will not provide the clean automated pivot that the demo videos suggest. In those cases, a manual approach using targeted WMI enumeration, selective credential use, and careful execution method rotation across longer time windows tends to produce better results and significantly lower detection risk.

Gang Leader For A Day Download and Availability Notes

The original repository is no longer publicly available on GitHub. The code exists on various mirror sites, archive repositories, and security researcher collections. There is no official download channel. Anyone hosting a direct download link is operating outside the original project's control. I would recommend verifying the source against the archived commit history if you intend to use it, because modified versions with injected payloads have appeared on some file hosting sites. The legitimate code compiles cleanly with no hidden dependencies when built from the original source tree, but mirroring sites do not always preserve the full repo structure. The framework remains useful as a reference implementation for understanding how automated lateral movement chains operate in Windows environments. The modular design maps clearly to ATT&CK techniques T1003, T1021, T1076, and T1558. Studying the code helps you understand the timing, failure modes, and detection surface of each technique in sequence, which is valuable for both offensive planning and defensive tuning. From a defensive standpoint, the most impactful controls are limiting LSASS access through Credential Guard and restricted admin mode, enforcing SMB signing and encryption, restricting WMI remote execution to authorized management stations, and monitoring for the specific event patterns each execution method generates. Detection does not require hunting for GLFAD specifically. The behavioral footprint overlaps heavily with other post-exploitation frameworks, and a rule set built around the technique pattern catches it regardless of the tool variant in use.