Wmiexec task #18
Merged
Wmiexec task #18
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Fix Windows path to SMB share-root path conversion (C:\Windows -> \Windows) - Update openFile/readFile/closeFile to use tree_id instead of share string - Use correct SMB API signatures matching smblib implementation - Import SMB constants (FILE_READ_DATA, FILE_SHARE_READ, FILE_SHARE_WRITE) - Fix deleteFile to use tree_id parameter - Remove placeholder return value in _read_remote_file error handling - Remove unused imports (os, tempfile) This ensures wmiexec task method properly reads output files via SMB. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Fix SMB path conversion (remove extra backslash: C:\path -> \path not \path) - Implement --sp/--save-path flag for output file location - Implement --sn/--save-name flag for custom output filename - Implement --working-dir flag for process working directory - Implement --shell flag (cmd/powershell) for command execution - Implement --raw-command flag for direct executable launch - Pass args object through execution chain for flag access - Update _create_wmi_process_traditional to accept working_dir parameter - All flags now properly extracted and used in command construction - Fix escape sequence warning in docstring Share-aware implementation: - Output paths use share-root syntax (\Windows\Temp\ not C:\Windows\Temp\) - SMB file operations use tree_id for proper share context - Supports arbitrary shares through existing SMB connection 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com}
- Move output redirection inside cmd.exe /c quotes for proper execution - Add 2 second delay before reading output file to allow process to complete - Add debug output for share and tree_id during file operations - Escape quotes properly in redirected command path The issue was that 'cmd.exe /c "command" > file' doesn't work because redirection is outside the /c scope. It must be 'cmd.exe /c "command > file"' for the redirection to be processed by the child cmd.exe instance. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Remove complex quote escaping that was preventing output redirection from working. WMI's Win32_Process.Create() needs simpler command syntax without escaped quotes.
- Replaced DCOM Win32_Process.Create with Task Scheduler DCE/RPC - Reuses existing schtasks infrastructure (_create_task, _run_task, _delete_task) - Added three helper methods: - _create_task_scheduler_task(): Creates task with XML definition - _run_task_scheduler_task(): Executes the created task - _delete_task_scheduler_task(): Cleans up task after execution - Supports all task flags: --tn, --sp, --sn, --working-dir, --shell, --raw-command, --no-cleanup - Uses proper Task Scheduler interface instead of WMI DCOM
Removed wmiexec task implementation as it duplicated atexec functionality: - Both use Task Scheduler via atsvc DCE/RPC interface - Both create → run → delete task workflow - atexec already provides share-aware task execution Removed methods: - wmiexec_handler() - task routing handler - execute_wmi_command_namedpipe() - named pipe execution - _execute_single_command_namedpipe() - single command exec - _execute_interactive_shell_namedpipe() - interactive shell - _create_task_scheduler_task() - task creation - _run_task_scheduler_task() - task execution - _delete_task_scheduler_task() - task cleanup - _execute_wmi_command_memory_capture() - memory capture method Removed CLI: - wmiexec task subparser with all flags - Updated help text to show: dcom, event, query methods Kept functionality: - wmiexec --show-endpoints (uses discover_wmi_endpoints) - wmiexec dcom, event, query methods - All WMI named pipe discovery methods Use 'atexec' for Task Scheduler-based execution instead.
- Updated error message to not reference 'wmiexec task' - Removed suggestion to use 'wmiexec task -i' for interactive mode - Cleaned up formatting (removed extra blank lines)
Changes: - Fixed 'DCETransport' has no attribute 'set_timeout' error - Set default global SMB timeout to 24 hours (86400 seconds) - Added --timeout CLI flag to override default timeout - Removed invalid set_timeout() call on DCETransport - Timeout is properly applied to SMB connection via config.smb_conn_timeout Usage: slinger --host 10.10.10.161 --user admin --ntlm :hash # Uses 24hr timeout slinger --host 10.10.10.161 --user admin --ntlm :hash --timeout 3600 # 1hr timeout
Ensures the global timeout setting is properly applied to: - SMBConnection initial creation (was hardcoded to 15) - SMBConnection._timeout attribute - DCE/RPC transport connections via set_connect_timeout() This ensures all underlying Impacket connections respect the --timeout flag.
Simplified timeout configuration to use standard config system:
- Added smb_conn_timeout to config_vars list (86400s = 24hr default)
- Changed all code to use get_config_value("smb_conn_timeout")
- Removed redundant module variable and special handling
- Now timeout can be changed via 'set' command or --timeout flag
This is cleaner - no duplicate logic, single source of truth in config_vars.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.