From 7bab60cc39196bc34beec9456d88909b54ab6d8a Mon Sep 17 00:00:00 2001 From: antonioCoco Date: Thu, 30 Sep 2021 22:57:05 +0200 Subject: [PATCH] changed some description text --- modules/download.py | 1 + modules/lateral_wmi.py | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/download.py b/modules/download.py index ce00f14..e0fe096 100644 --- a/modules/download.py +++ b/modules/download.py @@ -119,6 +119,7 @@ class Download(Module): try: with open(output_path, file_open_mode) as outfile: outfile.write(file_content) + # tune for Windows race condition on file access when the chunk_size is very small, weird... except PermissionError: sleep(1) with open(output_path, file_open_mode) as outfile: diff --git a/modules/lateral_wmi.py b/modules/lateral_wmi.py index da65d9c..8c56eaf 100644 --- a/modules/lateral_wmi.py +++ b/modules/lateral_wmi.py @@ -14,8 +14,8 @@ class Lateral_wmi(Module): This module run a wmic /node:[ip] command in order to launch commands on a remote windows system. This will result in a lateral movement if shared credentials are known. - Note that if you use local users credentials you should ensure that, on the target server, the feature - "LocalAccountTokenFilterPolicy" is disabled. + Note that if you use local admin credentials you should ensure that, on the target server, the feature + "LocalAccountTokenFilterPolicy" is disabled. (except for builtin Administrator) To disable that you need to add the following regkey with the value of 1: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy @@ -24,7 +24,7 @@ class Lateral_wmi(Module): reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f If you use domain users for the lateral movement, no restrictions to the process token will be applied. - Remember to always specify the domain in the username field. If you use a local account use + Remember to always specify the domain in the username field. If you use a local account use the machine name as the domain. This module uses WMI builtin features wmi and doesn't need additional files to be droppend on the target server.