Modify version of impacket wmiexec.py,wmipersist.py. Got output(data,response) from registry, don't need SMB connection, but I'm in the bad code :(
Specially Thanks to:
@rootclay, wechat: _xiangshan
In original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk.
In this case, I drop smb connection function and use others method to execute command.
- wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003).
BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it.
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration Name: EnableAt Type: REG_DWORD Value: 1
(Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running.
wmiexec-regOut.py: Just a simple Win32_Process.create method example .
How it works?
- WMIC authenticated remotly
- Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named [uuid].txt
- Encode the file content to base64 strings (need to wait a few seconds)
- Add the converted base64 string into registry, and key name call [uuid]
- Get the base64 strings remotly and decode it locally.
- Add custom vbs script into ActiveScriptEventConsumer class.
- Creating an Event Filter.
- Trigger FilterToConsumerBinding class to PWNED!
Generally, you just need to install official impacket.
With cleartext password
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
With NTLM hashes
python3 wmiexec-reg.py administrator:[email protected] 'whoami'
wmipersist-wip.py usage (Default is no output):
With cleartext password (without output)
python3 wmiexec-reg.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 [email protected] 'whoami'
With NTLM hashes
python3 wmipersist-wip.py administrator:[email protected] 'command'
python3 wmipersist-wip.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 [email protected] 'whoami'
Under Huorong antivirus-software (Using WMIHACKER VBS template!!!)
- Optimize code (In bad code now.)
- Add more functions