https://github.com/Cybereason/Invoke-WMILM

https://github.com/Cybereason/Invoke-WMILM

Last synced: 22 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/Cybereason/Invoke-WMILM
• Owner: Cybereason
• License: agpl-3.0
• Created: 2018-05-08T15:21:12.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2018-05-10T22:18:48.000Z (over 6 years ago)
• Last Synced: 2024-11-18T22:39:22.283Z (24 days ago)
• Language: PowerShell
• Size: 28.3 KB
• Stars: 229
• Watchers: 18
• Forks: 64
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - Cybereason/Invoke-WMILM - (PowerShell)

README

        
# Invoke-WMILM

This is a PoC script for various methods to acheive authenticated remote code execution via WMI, without (at least directly) using the Win32_Process class. The type of technique is determined by the "Type" parameter. 

## Parameters

* Target - Name or IP of target machine

* Type - The type of technique to use

* Protocol - Decides between the DCOM and Wsman (WinRM) protocols as the underlying transport. Default is DCOM

* Name - For techniques creating named objects (services, tasks etc.)

* Command - Executable to run

* CommandArgs - Arguments to the executable

* CleanUp - an optional phase to remove artifacts created by the various techniques

* Username

* Password

## Supported Techniques

* DerivedProcess - Creates a class deriving from Win32_Process, and calls the Create method of that class

* Service - Creates a service and runs it using WMI. Basically PSEXEC with different network traffic

* Job - Creates an at.exe style scheduled task to run in 30 seconds. Does not work on Win8+, unless at.exe is enabled

* Task - Creates an schtasks.exe style scheduled task and runs it. Works only on Win8+

* Product - Runs an arbitrary MSI file from a given path (given by the Command parameter)

* Provider - Creates a new provider with the command and arguments as the underlying COM object, and loads it