C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials (https://www.kitploit.com/search/label/Credentials) or the current user's session. Note: Some commands will use PowerShell (https://www.kitploit.com/search/label/PowerShell) in combination with WMI, denoted with ** in the --show-commands command.
Introduction
CIMplant is a C# rewrite and expansion on @christruncer (https://twitter.com/christruncer)'s WMImplant (https://github.com/FortyNorthSecurity/WMImplant). It allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows (https://www.kitploit.com/search/label/Windows) Management (https://www.kitploit.com/search/label/Management) Instrumentation, WMI (https://docs.microsoft.com/en-us/windows/win32/wmisdk/about-wmi), or Common Interface Model, CIM (https://www.dmtf.org/standards/cim) ; well more accurately Windows Management Infrastructure, MI (https://docs.microsoft.com/en-us/previous-versi%20%20%20ons/windows/desktop/wmi_v2/windows-management-infrastructure). CIMplant requires local administrator permissions on the target system.
Setup:
It's probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below. Load CIMplant.sln into Visual Studio Go to Build at the top and then Build Solution if no modifications are wanted
Usage
CIMplant.exe --help
CIMplant.exe --show-commands
CIMplant.exe --show-examples
CIMplant.exe -s [remote IP address] -c cat -f c:\users\user\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c cat -f c:\users\test\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c command_exec --execute "dir c:\\"

Some Helpful Commands

___________________________
@hacking_Attack
@Hacking_Video

Important Files Program.cs This is the brains of the operation, the driver for the program. Connector.cs This is where the initial CIM/WMI connections are made and passed to the rest of the application ExecuteWMI.cs All function code for the WMI commands ExecuteCIM.cs All function code for the CIM (MI) commands
Detection
Of course, the first thing we'll want to be aware of is the initial WMI or CIM connection. In general, WMI uses DCOM as a communication protocol whereas CIM uses WSMan (or, WinRM). This can be modified for CIM, and is in CIMplant, but let's just go over the default values for now. For DCOM, the first thing we can do is look for initial TCP connections over port 135. The connecting and receiving systems will then decide on a new, very high port to use so that will vary drastically. For WSMan, the initial TCP connection is over port 5985. Next, you'll want to look at the Microsoft-Windows-WMI-Activity/Trace event log in the Event Viewer. Search for Event ID 11 and filter on the IsLocal property if possible. You can also look for Event ID 1295 within the Microsoft-Windows-WinRM/Analytic log. Finally, you'll want to look for any modifications to the DebugFilePath property with the Win32_OSRecoveryConfiguration class. More detailed information about detection can be found at Part 1 of our blog series here: CIMplant Part 1: Detection of a C# Implementation of WMImplant (https://fortynorthsecurity.com/blog/cimplant-part-1-detections/)

Download CIMplant (https://github.com/FortyNorthSecurity/CIMplant)

___________________________
@hacking_Attack
@Hacking_Video

CIMplant - C# Port Of WMImplant Which Uses Either CIM Or WMI To Query Remote Systems

C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the --show-commands command.Introduction CIMplant is a C# rewrite and expansion on @christruncer's WMImplant. It allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system. Setup: It's probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below. Load CIMplant.sln into Visual Studio Go to Build at the top and then Build Solution if no modifications are wanted Usage CIMplant.exe --helpCIMplant.exe --show-commandsCIMplant.exe --show-examplesCIMplant.exe -s remote IP address -c cat -f c:\users\user\desktop\file.txtCIMplant.exe -s remote IP address -u username -d domain -p password -c cat -f c:\users\test\desktop\file.txtCIMplant.exe -s remote IP address -u username -d domain -p password -c command_exec --execute "dir c:\\" Some Helpful Commands Important Files Program.cs This is the brains of the operation, the driver for the program. Connector.cs This is where the initial CIM/WMI connections are made and passed to the rest of the application ExecuteWMI.cs All function code for the WMI commands ExecuteCIM.cs All function code for the CIM (MI) commands Detection Of course, the first thing we'll want to be aware of is the initial WMI or CIM connection. In general, WMI uses DCOM as a communication protocol whereas CIM uses WSMan (or, WinRM). This can be modified for CIM, and is in CIMplant, but let's just go over the default values for now. For DCOM, the first thing we can do is look for initial TCP connections over port 135. The connecting and receiving systems will then decide on a new, very high port to use so that will vary drastically. For WSMan, the initial TCP connection is over port 5985. Next, you'll want to look at the Microsoft-Windows-WMI-Activity/Trace event log in the Event Viewer. Search for Event ID 11 and filter on the IsLocal property if possible. You can also look for Event ID 1295 within the Microsoft-Windows-WinRM/Analytic log. Finally, you'll want to look for any modifications to the DebugFilePath property with the Win32_OSRecoveryConfiguration class. More detailed information about detection can be found at Part 1 of our blog series here: CIMplant Part 1: Detection of a C# Implementation of WMImplant Download CIMplant
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What are your pro tips for not getting caught? (in theory)

all the time in news i see breakers with god like skills getting caught whatever they do by agencies collabing on them ... which made me feel like it's something inevitable .. with no way around.

submitted by /u/theycallmemonlight
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ideas for a hacking presentation

So, for my language course we need to make a presentation about something, and I chose Hacking. Those are not tech savvy people so I want to make it interesting. I want to show them darkweb, WiFi hacking + password cracking, maybe email spoofing, maybe Anonynous + some interesting facts Do you have any other ideas or you maybe know some easy trick that anyone can learn really fast. Please leave a comment, all input will be appreciated

submitted by /u/Pavelosky
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Smartphone Genius hacks and tips in hindi

आप सभी लोग samrtphone का use करते ही होगे लेकिन आप को smartphone के ऐसी tricks And tips जो आपको पता ही नही होगा। आप सभिको मे ऐसी टिप्स एंड…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SSRF Exploitation: Breaking prtocols Part 3

https://cdn-images-1.medium.com/max/600/1*FaB_xpOtCI11HlZyvaAATA.jpeg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[HTB] Laboratory

https://cdn-images-1.medium.com/max/600/1*jMtbNJ1zZYqIVq5fDLxhMQ.png
Hack The Box — Laboratory

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox Offshore review

https://cdn-images-1.medium.com/max/1109/0*aODCYKdwMRN5kG5y
After significant struggle, I finally finished Offshore, a prolab offered by HackTheBox. I attempted this lab to improve my knowledge of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mechanical Vegetation: producing an original music video in 5 weeks

https://cdn-images-1.medium.com/max/2600/0*bwK9f6gSL9ck0cXr
How I went from sketch to produced video, engaging a range of skills including improvised movement, LEDs, mechanical design and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CIMplant - C# Port Of WMImplant Which Uses Either CIM Or WMI To Query Remote Systems

https://1.bp.blogspot.com/-KcEyq8IfPVg/YJhUl3X0XdI/AAAAAAAAWJ0/pX19pfbpJ8EVUeAo60WRQvqy0I2Pd9xaACNcBGAsYHQ/w400-h400/CIMplant_1_cimplant_logo_letters.png C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session.

Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the --show-commandscommand. IntroductionCIMplant is a C# rewrite and expansion on @christruncer's WMImplant. It allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system. Setup:It's probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below.

1. Load CIMplant.sln into Visual Studio
2. Go to Build at the top and then Build Solution if no modifications are wanted UsageCIMplant.exe --help
CIMplant.exe --show-commands
CIMplant.exe --show-examples
CIMplant.exe -s [remote IP address] -c cat -f c:\users\user\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c cat -f c:\users\test\desktop\file.txt
CIMplant.exe -s [remote IP address] -u [username] -d [domain] -p [password] -c command_exec --execute "dir c:\\" Some Helpful Commandshttps://1.bp.blogspot.com/-HBFoty7rD7U/YJhUyMJuasI/AAAAAAAAWJ4/Tn2wSiV_KQswCuSJfPhA9DcaMYTtLF6LwCNcBGAsYHQ/w640-h360/CIMplant_2_CIMplant-Help.gif Important Files1. Program.cs

This is the brains of the operation, the driver for the program.

1. Connector.cs

This is where the initial CIM/WMI connections are made and passed to the rest of the application

1. ExecuteWMI.cs

All function code for the WMI commands

1. ExecuteCIM.cs

All function code for the CIM (MI) commands DetectionOf course, the first thing we'll want to be aware of is the initial WMI or CIM connection. In general, WMI uses DCOM as a communication protocol whereas CIM uses WSMan (or, WinRM). This can be modified for CIM, and is in CIMplant, but let's just go over the default values for now. For DCOM, the first thing we can do is look for initial TCP connections over port 135. The connecting and receiving systems will then decide on a new, very high port to use so that will vary drastically. For WSMan, the initial TCP connection is over port 5985.

Next, you'll want to look at the Microsoft-Windows-WMI-Activity/Trace event log in the Event Viewer. Search for Event ID 11 and filter on the IsLocal property if possible. You can also look for Event ID 1295 within the Microsoft-Windows-WinRM/Analytic log.

Finally, you'll want to look for any modifications to the DebugFilePath property with the Win32_OSRecoveryConfiguration class. More detailed information about detection can be found at Part 1 of our blog series here: CIMplant Part 1: Detection of a C# Implementation of WMImplant Download CIMplant

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Four Arrested in Darkweb Child Abuse Site Investigation

https://external-preview.redd.it/uP98vTttUOzQa2JBlMZJ3i-ldjzh0akAc9_wSqMF0QU.jpg?width=640&crop=smart&auto=webp&s=7c59c48b11120cc8792aa2af7f9aa99079f8313b submitted by /u/kirby__000
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video