{"id":23007571,"url":"https://github.com/ice-wzl/wmiexec2","last_synced_at":"2025-08-14T03:31:42.900Z","repository":{"id":138768740,"uuid":"598828054","full_name":"ice-wzl/wmiexec2","owner":"ice-wzl","description":"wmiexec2.0 is the same wmiexec that everyone knows and loves (debatable).  This 2.0 version is obfuscated to avoid well known signatures from various AV engines.  It also has a handful of additional built in modules to help automate some common tasks on Red team engagements. ","archived":false,"fork":false,"pushed_at":"2024-06-12T17:56:15.000Z","size":164,"stargazers_count":24,"open_issues_count":1,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-06-14T00:11:18.857Z","etag":null,"topics":["antivirus","hacking","hacking-code","hacking-tools","malware","python","python-3","python-script","python3","red-team","red-team-engagement","red-team-tools","red-teaming"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ice-wzl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-07T22:10:08.000Z","updated_at":"2024-06-12T17:56:18.000Z","dependencies_parsed_at":"2024-06-12T23:55:29.287Z","dependency_job_id":"379a82f9-2ace-46b0-a0c0-25aa9cd4c25c","html_url":"https://github.com/ice-wzl/wmiexec2","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ice-wzl%2Fwmiexec2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ice-wzl%2Fwmiexec2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ice-wzl%2Fwmiexec2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ice-wzl%2Fwmiexec2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ice-wzl","download_url":"https://codeload.github.com/ice-wzl/wmiexec2/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":229795793,"owners_count":18125286,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["antivirus","hacking","hacking-code","hacking-tools","malware","python","python-3","python-script","python3","red-team","red-team-engagement","red-team-tools","red-teaming"],"created_at":"2024-12-15T08:16:27.007Z","updated_at":"2025-08-14T03:31:42.879Z","avatar_url":"https://github.com/ice-wzl.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ⚡ wmiexec2.0 ⚡\n\n\u003e **The stealthy upgrade to everyone's favorite `wmiexec` — obfuscated, enhanced, and red team ready.**  \n\u003e 💀 *Bypass AV. Automate engagements. Dominate.*\n\n---\n\n## 🚀 Features\n\n- 🎭 Obfuscated to evade signature-based AV detection\n- 🛠️ Built-in red team modules for rapid automation\n- 🐚 Supports `cmd` and `powershell` shell types\n- 📁 Local and remote file transfer (`lput`, `lget`)\n- 📡 Netsh tunneling, token abuse, VM detection, and more\n\n---\n\n## 📦 Installation\n\n```bash\ngit clone https://github.com/ice-wzl/wmiexec2.git\ncd wmiexec2/\npip3 install -r requirements.txt\n```\n\n\u003e ⚠️ **Do NOT use `wget` on GitHub Raw** — it will break emoji characters. Always use `git clone`.\n\n---\n\n## 🧪 AV / EDR Compatibility\n\n| Environment                                         | Result                     |\n|-----------------------------------------------------|----------------------------|\n| Windows Server 2022 (Feb 2024 updates)              | ✅ All modules working     |\n| Windows 10 Pro, Defender v1.381.3595.0              | ✅ All modules working     |\n| Windows 10 Pro, Kaspersky Standard 21.8.5           | ✅ All modules working     |\n| Windows 8, Defender v1.383.35.0                     | ✅ All modules working     |\n| Windows 7 Pro, Defender v1.95.191.0 (2010)          | ⚠️ Reg module not working |\n\n---\n\n## 🔧 Usage\n\n```bash\npython3 wmiexec2.py DOMAIN/USERNAME:PASSWORD@10.0.0.2 --shell-type powershell\npython3 wmiexec2.py WORKGROUP/Administrator:'Password123!@#'@10.0.0.4 --shell-type cmd\n```\n\n\u003e Supports both password and NTLM hash authentication\n\n---\n\n## 📚 Commands\n\n| Command                  | Description                                           |\n|--------------------------|-------------------------------------------------------|\n| `help`                   | Show available modules                                |\n| `lcd \u003cpath\u003e`             | Change local working directory                        |\n| `exit`                   | Exit shell                                            |\n| `lput \u003csrc\u003e \u003cdst\u003e`       | Upload file to target                                |\n| `lget \u003cfile\u003e`            | Download file from target                            |\n| `!\u003ccommand\u003e`             | Run a command locally (e.g., `!ls`)                   |\n| `ls [path]`              | List target directory (uses `dir /a`)                 |\n| `cat \u003cfile\u003e`             | Show remote file contents (alias for `type`)          |\n\n---\n\n## 🧠 Modules\n\n### `sysinfo`\nDisplay target user, hostname, IP, and architecture.\n\n```bash\nsysinfo\n```\n\n---\n\n### `av`\nLists common AV product processes via remote enumeration.\n\n```bash\nav\n```\n\n---\n\n### `defender`\nChecks Defender installation, service status, exclusions, and tamper protection.\n\n```bash\ndefender\n```\n\n---\n\n### `vmcheck`\nDetects ESXi, VMware, QEMU, and VirtualBox environments.\n\n```bash\nvmcheck\n```\n\n---\n\n### `unattend`\nSearches for unattended install config files that may contain credentials.\n\n```bash\nunattend\n```\n\n---\n\n### `regrip`\nDumps `SAM`, `SECURITY`, and `SYSTEM` hives (bypasses Defender as of 6/7/24).\n\n```bash\nregrip\n```\n\n---\n\n### `loggrab`\nDownload `.evtx` logs from remote system.\n\n```bash\nloggrab Security.evtx\n```\n\n---\n\n### `tokens`\nEnumerates active tokens and suggests privesc paths.\n\n```bash\ntokens\n```\n\n---\n\n### `survey` / `survey save`\nRun custom recon commands listed in `survey.conf`.\n\n```bash\nsurvey\nsurvey save\n```\n\n---\n\n### Netsh Tunneling\n\n```bash\naddtun 10000 10.0.0.5 443\nshowtun\ndeltun 10000\n```\n\n---\n\n## 🛠 Known impacket NAT Fix\n\nIf you get this error:\n\n```\n[-] Can't find a valid stringBinding to connect\n```\n\n### ➤ Fix\n\n1. Locate your `dcomrt.py`:\n   ```bash\n   find / -type f -name \"dcomrt.py\" 2\u003e/dev/null\n   ```\n\n2. Edit and replace:\n   ```python\n   # raise Exception(\"Can't find a valid stringBinding to connect\")\n   stringBinding = 'ncacn_ip_tcp:%s%s' % (self.get_target(), bindingPort)\n   LOG.info(\"Can't find a valid stringBinding to connect, using default!\")\n   ```\n\n✅ Done!\n\n---\n\n## 💡 Notes\n\n- This tool is **under active development** — submit PRs or issues.\n- All modules built for stealth and speed.\n- Use responsibly in authorized engagements.\n\n---\n\n## ⭐ If This Helped You\n\nIf `wmiexec2.0` saved you time or helped your ops:\n\u003e 🧠 Spread the knowledge. 🌍 Share the repo. ⭐ Star it.\n\n---\n\n## 👻 Author\n\n**ice-wzl**  \n🐙 GitHub: [ice-wzl](https://github.com/ice-wzl)  \n🛠️ Built with ❤️ for red teams.\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fice-wzl%2Fwmiexec2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fice-wzl%2Fwmiexec2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fice-wzl%2Fwmiexec2/lists"}