-
Notifications
You must be signed in to change notification settings - Fork 0
Modules
The modules can be found in the map "modules".
Run cme -M --options to view a modules supported options, e.g:
#~ cme smb -M mimikatz --options
Module options are specified with the -o flag. All options are specified in the form of KEY=value (msfvenom style)
Example:
#~ cme <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M mimikatz -o COMMAND='privilege::debug'
Executes the BloodHound recon script on the target and retrieves the results to the attackers' machine.
There are 2 supported modes :
- CSV : exports data into CSVs on the target file system before retreiving them (NOT opsec safe)
- Neo4j API : exports data directly to the Neo4j API (opsec safe)
-
THREADS Max numbers of threads to execute on target (defaults to 20)
-
COLLECTIONMETHOD Method used by BloodHound ingestor to collect data (defaults to 'Default')
-
CSVPATH (optional) Path where csv files will be written on target (defaults to C:)
-
NEO4JURI (optional) URI for direct Neo4j ingestion (defaults to blank)
-
NEO4JUSER (optional) Username for direct Neo4j ingestion
-
NEO4JPASS (optional) Pass for direct Neo4j ingestion
Give NEO4J options to perform direct Neo4j ingestion (no CSVs on target)
Uses Empire's RESTful API to generate a launcher for the specified listener and executes it
- LISTENER Listener name to generate the launcher for
Gathers information on all endpoint protection solutions installed on the the remote host(s) via WMI
Decrypts saved Chrome passwords using Get-ChromeDump
Uses WMI to dump DNS from an AD DNS Server
- DOMAIN Domain to enumerate DNS for. Defaults to all zones.
Logs keys pressed, time and the active window
- TIMEOUT Specifies the interval in minutes to capture keystrokes.
- STREAM Specifies whether to stream the keys over the network (default: False)
- POLL Specifies the interval in seconds to poll the log file (default: 20)
Enumerates all domain controllers
- INJECT If set to true, this allows the module to work over 'stealthier' execution methods which have non-interactive contexts (e.g. WMI) (default: True)
Enumerates all active RDP sessions
- INJECT If set to true, this allows the module to work over 'stealthier' execution methods which have non-interactive contexts (e.g. WMI) (default: True)
Takes screenshots at a regular interval
Searches the domain controller for registry.xml to find autologon information and returns the username and password.
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
Digs up saved session information for PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP using SessionGopher
Injects a VNC client in memory
Downloads the Meterpreter stager and injects it into memory
Dumps all logon credentials from memory
Decrypts saved Chrome passwords using Mimikatz
Decrypts saved credentials in Windows Vault/Credential Manager
Executes Mimikittenz
Patches terminal services in memory to allow multiple RDP users
Capture's credentials by using API hooking
Downloads the specified DLL/EXE and injects it into memory
Enables/Disables RDP
Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares
Downloads the specified raw shellcode and injects it into memory
Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions
Pings a host
Enumerates available tokens
Checks UAC status
Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1
Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module
- URL URL for the download cradle