Kali Linux

wmiexec-RegOut : Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry

wmiexec-RegOut is the modify version of impacket wmiexec.py, wmipersist.py. Got output(data, response) from registry, don’t need SMB connection, but I’m in the bad code.

Overview

In original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk.
In this case, I drop smb connection function and use others method to execute command.

  • wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003).
    BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
Name: EnableAt
Type: REG_DWORD
Value: 1

  • wmipersist-wip.py (Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running.
  • wmiexec-regOut.py: Just a simple Win32_Process.create method example .

How it works?

  • wmiexec-wip.py workflow:Step 1:
    • WMIC authenticated remotly
    Step 2:
    • Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named [uuid].txt
    Step 3:
    • Encode the file content to base64 strings (need to wait a few seconds)
    Step 4:
    • Add the converted base64 string into registry, and key name call [uuid]
    Step 5:
    • Get the base64 strings remotly and decode it locally.
  • wmipersist-wip.py workflow:Step 1:
    • Add custom vbs script into ActiveScriptEventConsumer class.
    Step 2:
    • Creating an Event Filter.
    Step 3:
    • Trigger FilterToConsumerBinding class to PWNED!

Requirements

Generally, you just need to install official impacket.

  • Portal

Usage

  • wmiexec-wip.py usage:With cleartext password

python3 wmiexec-reg.py administrator:111qqq…@192.168.10.90 ‘whoami’

wmipersist-wip.py usage (Default is no output):

With cleartext password (without output)

python3 wmipersist-wip.py administrator:111qqq…@192.168.10.20 ‘command’

R K

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

4 hours ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

13 hours ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

13 hours ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

14 hours ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

14 hours ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

14 hours ago