Catalog WADComs

WAD · Tool

Evil

3 techniques Linux · Windows · ActiveDirectoryWADComs GPL-3.0

Evil-WinRM-PTH

Execution LinuxWindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Evil-WinRM supports passing the victim's NT hash for authorization. Command Reference: Target IP: 10.10.10.1 Username: john NT Hash: c23b2e293fa0d312de6f59fd6d58eae3

evil-winrm -i 10.10.10.1 -u john -H c23b2e293fa0d312de6f59fd6d58eae3
Native
Exploitation
Requires
Username, Hash
Services
WMI

Evil-WinRM

Execution LinuxWindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 Username: john Password: password123

evil-winrm -i 10.10.10.1 -u john -p password123
Native
Exploitation
Requires
Password, Username
Services
WMI

Evil-Winrm-PKINIT

Execution WindowsActiveDirectory

Evil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Winrm Supports PKINIT, meaning if you have a computers PFX file, you can authenticate and get a shell. Note that the command requires a public and a private key in PEM format, that can be extracted by converting the PFX to PEM format. Take a look at the references for more info on that. Password protected PFX files can be cracked with JohnTheRipper. Command Reference: Target IP: 10.10.10.1 PFX File: cert.pfx Domain: EVILCORP

evil-winrm -i 10.10.10.1 -c pub.pem -k priv.pem -S -r EVILCORP
Native
Exploitation
Requires
PFX
Services
WMI