Releases: XiaoliChan/wmiexec-Pro
Releases · XiaoliChan/wmiexec-Pro
wmiexec-Pro v0.2.7
Changelog:
- Default is using VBS obfuscate in command execution
- Bypass windows defender in
semi-interactive shell
mode
Screenshot:
![image](https://private-user-images.githubusercontent.com/30458572/320270007-1f92ace5-7fe8-4088-9e35-e2aa3861c5c2.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3Mzk0ODIwMjMsIm5iZiI6MTczOTQ4MTcyMywicGF0aCI6Ii8zMDQ1ODU3Mi8zMjAyNzAwMDctMWY5MmFjZTUtN2ZlOC00MDg4LTllMzUtZTJhYTM4NjFjNWMyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTAyMTMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUwMjEzVDIxMjIwM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTIxNzRlOWFmYWJjNzE1ZjU0MWY0ZGQ5NWY2ZDJjMTc3Nzc2NmNlMmRjNWM3OGE4YmM5N2YyODZiYmNmMmZhMjgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.Wg9g1O2AHI7idPJc7uRoQbn-MoVtJv-gHUznqkz4VSk)
wmiexec-Pro v0.2.6
Changelog:
- Bugs fixed in
exec-command
wmiexec-Pro v0.2.5
Changelog:
- Add
lognuke
, history
, clear
, upload
, download
builtin commands in semi-interactive shell
Demonstrate:
![asciicast](https://camo.githubusercontent.com/8b0b7ee434ebe6c867df8af9d00c1585c173a38dcb961a3e9622d6ac658824f5/68747470733a2f2f61736369696e656d612e6f72672f612f424951614b51524147624d63654349755363435448457347582e737667)
wmiexec-Pro v0.2.4
Changelog:
- Use VBScript to invoke
SetSecurityDescriptor
method to grant access permissions instead of executing cmd. (Only works on system versions which is higher than NT6)
Screenshots:
![image](https://user-images.githubusercontent.com/30458572/236736170-cac4a86a-a023-4f45-9d33-e287db0dc4aa.png)
🎉 Special thanks @422926799 🎉
wmiexec-Pro v0.2.3
Changelog:
- Add codec functions in semi-interactive shell mode
wmiexec-Pro v0.2.2
Changelog:
- Add deep clean function in execute VBS
Screenshots:
-
In this demonstration, I break the command execution after creating wmi event, which means this command will never stop if we forget the event id.
![image](https://user-images.githubusercontent.com/30458572/236613191-4bbde738-c024-4180-958d-7afc4a0c029b.png)
-
So, with -deep-clean (
clearin
exec-commandmodule also is invoke the
depp-clean` function), we can stop the wmi event even forget the event id.
![image](https://user-images.githubusercontent.com/30458572/236613361-1c131a3e-435b-447a-9cf2-032a4e8f41ef.png)
wmiexec-Pro v0.2.1-fixed
Changelog:
- Add 'Try except' when getting command results
wmiexec-Pro v0.2.1
Changelog:
- Add logging / delay functions in semi-interactive shell mode
Screenshots:
wmiexec-Pro v0.2.0-fixed
Changelog:
- Base64 encode cwd path to avoid latin-1 encode error.
Screenshots:
-
Before
![image](https://user-images.githubusercontent.com/30458572/236596573-bf1f512c-ad13-44a4-8d72-171de55498a5.png)
-
After
![image](https://user-images.githubusercontent.com/30458572/236596584-a1c4958c-d416-498d-b809-4ab81fe0ab97.png)
wmiexec-Pro v0.2.0
Changelog:
- Add semi-interactive shell mode. (only work with system version higher than NT6)
Screenshots: