wmiexec-Pro v0.1.7-fixed

Changelog:

• Fix single quotes issues.

wmiexec-Pro v0.1.7

Changelog:

• Base64 encodes command in the exec-command module to avoid Latin-1 encoding error.
• Base64 encodes filename in the filetransfer module to avoid Latin-1 encoding error.
• exec-command: default is with output mode

Screenshots:

• File transferring with Chinese filename.
  

• Execute commands with Chinese characters.
  

wmiexec-Pro v0.1.6

Changelog:

• More operation in RID-Hijack module: remove / backup / restore

Screenshot:

wmiexec-Pro v0.1.5

Changelog:

• Bug fixed in filetransfer.py & service_mgr.py
• Use DEFAULT namespace when using the class StdRegProv
• New module: RID-Hijack (without using PowerShell or landing EXE file).

Special thanks: 九世 for rid-hijack module development.

Screenshot:

• Target: windows server 2019 (non-domain join)

• Help manual:
  

• Query user rid: (as you can see, the guest user current was disabled)
  

• Activate user:
  

• At first, we don't have any permission to access subkeys in HKLM\SAM\SAM, so let we grant permission to access it.
  

• Then we can modify the RID 501 profile, now is time to hijack to RID 500
  

• Finally, we can enable blank password login playing with guest user
  

• Attempt to login target with user guest without any password, before you login, you may need to modify your client GPO
  

• Execute command
  

wmiexec-Pro v0.1.4

Changelog:

• Firewall module: No more info replacement.
• Winrm module: Hard-coding firewall rule id in order to speed up configuration.

wmiexec-Pro v0.1.3

Changelog:

• Improve old system command execution in silent mode, no more VBScript, use win32_ScheduleJob directly.

Screenshots:

• Execute command in server 2003 with silent mode.
  

wmiexec-Pro v0.1.2-fixed

Changelog:

• Increase the delay time for command execution in the old style. (Win32_ScheduledJob)
• For more details, check out this link: wmiexec-Pro v0.1.2

wmiexec-Pro v0.1.2

Changelog:

• New module: Enum
• RDP module: add support for old version system under NT6 (Server 2003).
• Exec-command module: add support for old version system under NT6 (Server 2003).
• Rename directory vbs-scripts to vbscripts

Screenshots:

• Enumerate module:
  
  

• Enable RDP in server 2003
  

• Execute command in server 2003
  

wmiexec-Pro v0.1.1-fixed

Changelog:

• Now you can execute commands including double quotes or single quotes.

Screenshots:

• With double quotes:
  

• With single quotes:
  

wmiexec-Pro v0.1.1

Changelog:

• Fix a bug in VBScript: Exec-Command-WithOutput.vbs