Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

SharpStat

SharpStat C utility that uses WMI to run "cmd.exe /c netstat -n", save the output to a file, then use SMB to read and delete the file remotely Description This script will attempt to connect to all the supplied computers and use WMI to execute cmd.exe /c netstat -n . The file the output is saved ...

gargamel

Gargamel Compile Compiled and tested with Rust 1.50+. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or target/debug/gargamel.exe,...

CobaltStrike-BOF

CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...

netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

NorkNork

NorkNork - Tool for identifying Empire persistence payloads https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ ABOUT: This script was designed to identify Powershell Empire persistence payloads on Windows systems. It currently supports checks for these persistence methods:...

WMIHACKER

WMIHACKER（No need 445 Port） 中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common...

TChopper

TChopper New technique I have discovered recently and give it a nickname Chop chop to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool. image How it works the tool will get the...

RemoteRecon

RemoteRecon Remote Recon and Collection RemoteRecon provides the ability to execute post-exploitation capabilities against a remote host, without having to expose your complete toolkit/agent. Often times as operator's we need to compromise a host, just so we can keylog or screenshot or some other...

nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

WMEye

WMEye WMEye is an experimental tool that was developed when exploring about Windows WMI. The tool is developed for performing Lateral Movement using WMI and remote MSBuild Execution. It uploads the encoded/encrypted shellcode into remote targets WMI Class Property, create an event filter that whe...

WMIExec

WMIexec Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute...

HiddenNetworks-Python

HiddenNetworks-Python v0.9 May 2020 Hidden Networks is a new concept test based on the paper of the same name, that is programmed using Python 3.4. It facilitates the task of analysing local and remote machines within a domain, using WMI in searching for traces of connections by USB devices. With...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

CIMplant

CIMplant C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and...

SysmonConfigPusher2

SysmonConfigPusher v2 A web-based tool for managing Sysmon configurations across Windows endpoints — supports both agentless WMI/SMB and agent-based deployments. Features Feature| Description ---|--- Agentless Deployment| Push Sysmon binaries and configs via WMI and SMB Agent Support| Lightweight...

SharpStrike

SharpStrike SharpStrike is a post-exploitation tool written in C that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...