9fa0a40edf
- manuales.py cosecha el --help de las herramientas que no traen man page (ffuf, sqlmap, suite impacket, netexec, hydra...) y lo escribe como markdown en conocimiento/09 - Manuales/. Es la referencia de opciones que la man page no da; complementa el cheatsheet de invocaciones comunes. - indexa.py --publico construye saber-publico.jsonl: glosario + pack de conocimiento con los vectores ya calculados, 100% publico y portable. - busca.py usa ese indice publico como fallback cuando no hay indice personal, asi un clon recien hecho consulta al instante sin reindexar nada. - .gitignore deja pasar saber-publico.jsonl; el personal (saber.jsonl) sigue fuera. - docs/rag.md y el README del pack documentan ambas cosas.
61 lines
3.1 KiB
Markdown
61 lines
3.1 KiB
Markdown
# impacket-wmiexec — manual
|
|
|
|
Salida de `impacket-wmiexec -h`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
|
|
|
|
```
|
|
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
|
|
|
|
usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-silentcommand]
|
|
[-debug] [-codec CODEC] [-shell-type {cmd,powershell}]
|
|
[-com-version MAJOR_VERSION:MINOR_VERSION]
|
|
[-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]
|
|
[-dc-ip ip address] [-A authfile] [-keytab KEYTAB]
|
|
target [command ...]
|
|
|
|
Executes a semi-interactive shell using Windows Management Instrumentation.
|
|
|
|
positional arguments:
|
|
target [[domain/]username[:password]@]<targetName or address>
|
|
command command to execute at the target. If empty it will
|
|
launch a semi-interactive shell
|
|
|
|
options:
|
|
-h, --help show this help message and exit
|
|
-share SHARE share where the output will be grabbed from (default
|
|
ADMIN$)
|
|
-nooutput whether or not to print the output (no SMB connection
|
|
created)
|
|
-ts Adds timestamp to every logging output
|
|
-silentcommand does not execute cmd.exe to run given command (no
|
|
output)
|
|
-debug Turn DEBUG output ON
|
|
-codec CODEC Sets encoding used (codec) from the target's output
|
|
(default "utf-8"). If errors are detected, run
|
|
chcp.com at the target, map the result with https://do
|
|
cs.python.org/3/library/codecs.html#standard-encodings
|
|
and then execute wmiexec.py again with -codec and the
|
|
corresponding codec
|
|
-shell-type {cmd,powershell}
|
|
choose a command processor for the semi-interactive
|
|
shell
|
|
-com-version MAJOR_VERSION:MINOR_VERSION
|
|
DCOM version, format is MAJOR_VERSION:MINOR_VERSION
|
|
e.g. 5.7
|
|
|
|
authentication:
|
|
-hashes LMHASH:NTHASH
|
|
NTLM hashes, format is LMHASH:NTHASH
|
|
-no-pass don't ask for password (useful for -k)
|
|
-k Use Kerberos authentication. Grabs credentials from
|
|
ccache file (KRB5CCNAME) based on target parameters.
|
|
If valid credentials cannot be found, it will use the
|
|
ones specified in the command line
|
|
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256
|
|
bits)
|
|
-dc-ip ip address IP Address of the domain controller. If ommited it use
|
|
the domain part (FQDN) specified in the target
|
|
parameter
|
|
-A authfile smbclient/mount.cifs-style authentication file. See
|
|
smbclient man page's -A option.
|
|
-keytab KEYTAB Read keys for SPN from keytab file
|
|
```
|