mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
maxdcb
68 lines
1.8 KiB
JSON
68 lines
1.8 KiB
JSON
{
|
|
"name": "wmiExec",
|
|
"display_name": "wmiExec",
|
|
"kind": "module",
|
|
"description": "Execute a command through WMI.",
|
|
"command_template": "wmiExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {dc:q?} {target:q} {command:raw}",
|
|
"target": "beacon",
|
|
"requires_session": true,
|
|
"platforms": ["windows"],
|
|
"archs": ["x86", "x64", "arm64"],
|
|
"args": [
|
|
{
|
|
"name": "--vault",
|
|
"type": "credential",
|
|
"required": false,
|
|
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
|
|
"credential_filter": {
|
|
"type": "password"
|
|
}
|
|
},
|
|
{
|
|
"name": "auth_mode",
|
|
"type": "enum",
|
|
"required": false,
|
|
"description": "Authentication mode.",
|
|
"values": ["-u", "-k", "-n"]
|
|
},
|
|
{
|
|
"name": "username",
|
|
"type": "text",
|
|
"required": false,
|
|
"description": "DOMAIN\\Username for explicit -u mode."
|
|
},
|
|
{
|
|
"name": "password",
|
|
"type": "text",
|
|
"required": false,
|
|
"description": "Password for -u mode."
|
|
},
|
|
{
|
|
"name": "dc",
|
|
"type": "text",
|
|
"required": false,
|
|
"description": "Domain controller or DOMAIN\\dc value for -k mode."
|
|
},
|
|
{
|
|
"name": "target",
|
|
"type": "text",
|
|
"required": true,
|
|
"description": "Target host name or IP."
|
|
},
|
|
{
|
|
"name": "command",
|
|
"type": "text",
|
|
"required": true,
|
|
"description": "Remote command tail.",
|
|
"variadic": true
|
|
}
|
|
],
|
|
"examples": [
|
|
"wmiExec --vault cred:credentialId target whoami.exe",
|
|
"wmiExec -u DOMAIN\\Username Password123! target powershell.exe -nop -w hidden",
|
|
"wmiExec -k DOMAIN\\dc target whoami.exe /all",
|
|
"wmiExec -n localhost whoami.exe"
|
|
],
|
|
"source": "manifest"
|
|
}
|