CatalogWADComs

WAD · Tool

Evil

3 techniquesLinux · Windows · ActiveDirectoryWADComsGPL-3.0

Evil-WinRM-PTH

ExecutionLinuxWindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Evil-WinRM supports passing the victim's NT hash for authorization. Command Reference: Target IP: 10.10.10.1 Username: john NT Hash: c23b2e293fa0d312de6f59fd6d58eae3

evil-winrm -i 10.10.10.1 -u john -H c23b2e293fa0d312de6f59fd6d58eae3
Evidence
Upstream reference
Environment
Active Directory
Native
Exploitation
Requires
Username, NTLM hash
Services
WMI

Evil-WinRM

ExecutionLinuxWindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 Username: john Password: password123

evil-winrm -i 10.10.10.1 -u john -p password123
Evidence
Upstream reference
Environment
Active Directory
Native
Exploitation
Requires
Password, Username
Services
WMI

Evil-Winrm-PKINIT

ExecutionWindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Winrm Supports PKINIT, meaning if you have a computers PFX file, you can authenticate and get a shell. Note that the command requires a public and a private key in PEM format, that can be extracted by converting the PFX to PEM format. Take a look at the references for more info on that. Password protected PFX files can be cracked with JohnTheRipper. Command Reference: Target IP: 10.10.10.1 PFX File: cert.pfx Domain: EVILCORP

evil-winrm -i 10.10.10.1 -c pub.pem -k priv.pem -S -r EVILCORP
Evidence
Upstream reference
Environment
Active Directory
Native
Exploitation
Requires
Certificate
Services
WMI