Modules

The modules can be found in the map "modules".

Viewing module options

Run cme -M --options to view a modules supported options, e.g:

#~ cme smb -M mimikatz --options

Using module options

Module options are specified with the -o flag. All options are specified in the form of KEY=value (msfvenom style)

Example:

#~ cme <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M mimikatz -o COMMAND='privilege::debug'

List of modules:

bloodhound

Executes the BloodHound recon script on the target and retrieves the results to the attackers' machine.
There are 2 supported modes :

1. CSV : exports data into CSVs on the target file system before retreiving them (NOT opsec safe)
2. Neo4j API : exports data directly to the Neo4j API (opsec safe)

Options

• THREADS Max numbers of threads to execute on target (defaults to 20)

• COLLECTIONMETHOD Method used by BloodHound ingestor to collect data (defaults to 'Default')

• CSVPATH (optional) Path where csv files will be written on target (defaults to C:)

• NEO4JURI (optional) URI for direct Neo4j ingestion (defaults to blank)

• NEO4JUSER (optional) Username for direct Neo4j ingestion

• NEO4JPASS (optional) Pass for direct Neo4j ingestion

    Give NEO4J options to perform direct Neo4j ingestion (no CSVs on target)
  

empire_exec

Uses Empire's RESTful API to generate a launcher for the specified listener and executes it

Options

• LISTENER Listener name to generate the launcher for

enum_avproducts

Gathers information on all endpoint protection solutions installed on the the remote host(s) via WMI

enum_chrome

Decrypts saved Chrome passwords using Get-ChromeDump

enum_dns

Uses WMI to dump DNS from an AD DNS Server

Options

• DOMAIN Domain to enumerate DNS for. Defaults to all zones.

get_keystrokes

Logs keys pressed, time and the active window

Options

• TIMEOUT Specifies the interval in minutes to capture keystrokes.
• STREAM Specifies whether to stream the keys over the network (default: False)
• POLL Specifies the interval in seconds to poll the log file (default: 20)

get_netdomaincontroller

Enumerates all domain controllers

Options

• INJECT If set to true, this allows the module to work over 'stealthier' execution methods which have non-interactive contexts (e.g. WMI) (default: True)

get_netrdpsession

Options

Enumerates all active RDP sessions

• INJECT If set to true, this allows the module to work over 'stealthier' execution methods which have non-interactive contexts (e.g. WMI) (default: True)

get_timedscreenshot

Takes screenshots at a regular interval

gpp_autologin

Searches the domain controller for registry.xml to find autologon information and returns the username and password.

gpp_password

Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

invoke_sessiongopher

Digs up saved session information for PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP using SessionGopher

invoke_vnc

Injects a VNC client in memory

met_inject

Downloads the Meterpreter stager and injects it into memory

mimikatz

Dumps all logon credentials from memory

mimikatz_enum_chrome

Decrypts saved Chrome passwords using Mimikatz

mimikatz_enum_vault_creds

Decrypts saved credentials in Windows Vault/Credential Manager

mimikittenz

Executes Mimikittenz

multirdp

Patches terminal services in memory to allow multiple RDP users

netripper

Capture's credentials by using API hooking

pe_inject

Downloads the specified DLL/EXE and injects it into memory

rdp

Enables/Disables RDP

scuffy

Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares

shellcode_inject

Downloads the specified raw shellcode and injects it into memory

slinky

Creates windows shortcuts with the icon attribute containing a UNC path to the specified SMB server in all shares with write permissions

test_connection

Pings a host

tokens

Enumerates available tokens

uac

Checks UAC status

wdigest

Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1

web_delivery

Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module

Options

• URL URL for the download cradle