LiquidSnake

Liquid Snake Liquid Snake é um programa que visa realizar movimentação lateral contra sistemas Windows sem tocar no disco. A ferramenta depende da Subscrição de Eventos WMI para executar um assembly .NET na memória; o assembly .NET irá escutar por um shellcode em um named pipe e então executá-lo...

PowerLurk

PowerLurk PowerLurk ist ein PowerShell-Toolset zur Erstellung bösartiger WMI-Ereignisabonnements. Ziel ist es, das Auslösen von WMI-Ereignissen während eines Penetrationstests oder Red-Team-Einsatzes zu erleichtern. Weitere Informationen finden Sie in meinem Beitrag Creeping on Users with WMI...

StayKit - Cobalt Strike Kit For Persistence

StayKit is an extension for Cobalt Strike persistence by leveraging the executeassembly function with the SharpStay .NET assembly. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use the script a user will only need to load...

WMI Event Subscription Persistence

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'msf/core/post/windows/powershell' require 'msf/core/post/file' class MetasploitModule 'WMI Event Subscription Persistence',...

WMI Event Subscription Logon Timer Persistence

This module will create a permanent WMI event subscription to achieve file-less persistence using an event filter that will trigger the payload after the system has a certain uptime. Payloads will trigger every minute until the set end time. Additionally a custom command can be specified to run...