SharpStat

SharpStat C utility that uses WMI to run "cmd.exe /c netstat -n", save the output to a file, then use SMB to read and delete the file remotely Description This script will attempt to connect to all the supplied computers and use WMI to execute cmd.exe /c netstat -n . The file the output is saved ...

WMIHACKER

WMIHACKER（No need 445 Port） 中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common...

Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

MoreImpacketExamples

MoreImpacketExamples Este repositorio contiene algunos scripts cortos de Python creados con la librería Impacket. El objetivo principal de este proyecto es ayudarme a mí mismo y a otros que buscan pasar de usar los ejemplos proporcionados de impacket a modificar/crear sus propios scripts. Estos...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 Static Malware Analysis – Follina Exploitation CVE-2022-30190 Malicious Microsoft Word Document Investigation During a practical malware analysis session on Kali Linux, I encountered a suspicious file named sample.doc. I decided to perform a structured stat...

WMI Authenticated Exec Via Powershell Authenticated Exploit

This Metasploit module uses WMI execution to launch a payload instance on a remote machine. In order to avoid AV detection, all execution is performed in memory via psh-net encoded payload. Persistence option can be set to keep the payload looping while a handler is present to receive it. By...

Authenticated WMI Exec Via Powershell

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/powershell' require 'msf/core/post/windows/priv' require 'msf/core/exploit/powershell/dotnet' class MetasploitModule...

Authenticated WMI Exec via Powershell

This module uses WMI execution to launch a payload instance on a remote machine. In order to avoid AV detection, all execution is performed in memory via psh-net encoded payload. Persistence option can be set to keep the payload looping while a handler is present to receive it. By default the...