WMImplant

WMImplant WMImplant は、WMI を活用して対象マシンに対するアクションを実行するだけでなく、C2 チャネルとしてコマンドの発行と結果の受信を行う PowerShell ベースのツールです。WMImplant は対象マシン上でローカル管理者権限が必要になる可能性があります。 開発者: @christruncer WMImplant 機能: メタ関数 root@kitploit: changeuser - WMI コマンドを実行するユーザーコンテキストを変更します exit - WMImplant を終了します gencli - 非対話的に WMImplant...

CIMplant - C# Port Of WMImplant Which Uses Either CIM Or WMI To Query Remote Systems

C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and expansion...

Gargamel - A Forensic Evidence Acquirer

A Forensic Evidence Acquirer Compile Assuming you have Rust 1.41+ installed. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or...

WMI Based Agentless Post-Exploitation PowerShell RAT: WMImplant

WMImplant is a PowerShell based tool that leverages WMI to both perform actions against targeted machines, but also as the C2 channel for issuing commands and receiving results. WMImplant will likely require local administrator permissions on the targeted machine. It is designed to run both...

WMImplant – A WMI Based Agentless Post-Exploitation RAT Developed in PowerShell

Just over one year ago November 2015, I released WMIOps, a PowerShell script that enables a user to carry out different actions via Windows Management Instrumentation WMI on the local machine or a remote machine. WMIOps can: Start or stop a process. Return a list of all running processes. Power...