Invoke-TheHash

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege i...

Persistence-Survivability

Persistence Survivability Rating This project uses the Duqu style persistence as a TTP and was presented at Bsides Augusta – RAT. This project is PowerShell based and can be used with credentials and without. For more info please read the .ps1 file. Basic use: Invoke-FindPersitence...

NorkNork

NorkNork - Tool for identifying Empire persistence payloads https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ ABOUT: This script was designed to identify Powershell Empire persistence payloads on Windows systems. It currently supports checks for these persistence methods:...

WMImplant

WMImplant WMImplant is a PowerShell based tool that leverages WMI to both perform actions against targeted machines, but also as the C2 channel for issuing commands and receiving results. WMImplant will likely require local administrator permissions on the targeted machine. Developed by...

wmi-static-spoofer

wmi-static-spoofer Motivation: The initial motivation is bypassing HWID detection methods used by intrusive software like anti-cheats, etc. or licensing restrictions implemented in software. The concept is not new but other solutions require a loaded driver at all times and a kernel hook with...

CIMplant

CIMplant C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...

WMEye

WMEye WMEye is an experimental tool that was developed when exploring about Windows WMI. The tool is developed for performing Lateral Movement using WMI and remote MSBuild Execution. It uploads the encoded/encrypted shellcode into remote targets WMI Class Property, create an event filter that whe...

WMIHACKER

WMIHACKER（No need 445 Port） 中文版Chinese version Disclaimer: The technology involved in this project is only for security learning and defense purposes, illegal use is prohibited! Bypass anti-virus software lateral movement command execution test tool（No need 445 Port） Introduction: The common...

SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

WMIExec

WMIexec Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...

Perfusion

Perfusion On Windows 7 , Windows Server 2008R2 , Windows 8 , and Windows Server 2012 , the registry key of the RpcEptMapper and DnsCache 7/2008R2 only services is configured with weak permissions. Any local user can create a Performance subkey and then leverage the Windows Performance Counters to...

CVE-2026-98200

A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...

WMIcmd

The problem When doing low impact investigations and other similar activities you may want to minimize what is written to disk / obvious. This tool allows us to execute commands via WMI and get information not otherwise available via this channel. Purpose A small utility which only uses WMI to...

CcmMessagingBackdoor

CcmMessagingBackdoor Proof of Concept tooling to build and install a rogue CcmMessaging service to maintain access on a Management Point Usage Compile and install the rogue COM service on the Management Point Compile PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe /t:library...

WmiExec

WmiExec.ps1 Remote execution tools for Windows that rely only on WMI and PowerShell. Execute console commands remotely and capture stdout/stderr streams without relying on PowerShell Remoting, WinRM or PsExec. Examples Blog post and video about this technique. The example below shows you how...

osquery_cve-2024-23443

Proof of Concept POC CVE-2024-23443 hpbiososquery Add osqery extension HP BIOS WMI to Elastic Agent Dependencies pip install pywin32 pip install osquery pip install pyinstaller Build pyinstaller --onefile hpbiosenumeration.py Install 1. Copy extension to Elastic agent location copy...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 Static Malware Analysis – Follina Exploitation CVE-2022-30190 Malicious Microsoft Word Document Investigation During a practical malware analysis session on Kali Linux, I encountered a suspicious file named sample.doc. I decided to perform a structured stat...