1717# Constants
1818
1919# Version
20- VERSION = '2.3 '
20+ VERSION = '2.4 '
2121
2222# Msg types
2323TYPE_INFO = 0
4646$user = ""
4747$password = ""
4848$url = "wsman"
49+ $default_service = "HTTP"
4950
5051# Redefine download method from winrm-fs
5152module WinRM
@@ -85,9 +86,9 @@ class EvilWinRM
8586
8687 # Arguments
8788 def arguments ( )
88- options = { port :$port, url :$url }
89+ options = { port :$port, url :$url, service :$service }
8990 optparse = OptionParser . new do |opts |
90- opts . banner = "Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM]"
91+ opts . banner = "Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] [--spn SPN_PREFIX] "
9192 opts . on ( "-S" , "--ssl" , "Enable ssl" ) do |val |
9293 $ssl = true
9394 options [ :port ] = "5986"
@@ -96,10 +97,11 @@ def arguments()
9697 opts . on ( "-k" , "--priv-key PRIVATE_KEY_PATH" , "Local path to private key certificate" ) { |val | options [ :priv_key ] = val }
9798 opts . on ( "-r" , "--realm DOMAIN" , "Kerberos auth, it has to be set also in /etc/krb5.conf file using this format -> CONTOSO.COM = { kdc = fooserver.contoso.com }" ) { |val | options [ :realm ] = val . upcase }
9899 opts . on ( "-s" , "--scripts PS_SCRIPTS_PATH" , "Powershell scripts local path" ) { |val | options [ :scripts ] = val }
100+ opts . on ( "--spn SPN_PREFIX" , "SPN prefix for Kerberos auth (default HTTP)" ) { |val | options [ :service ] = val }
99101 opts . on ( "-e" , "--executables EXES_PATH" , "C# executables local path" ) { |val | options [ :executables ] = val }
100102 opts . on ( "-i" , "--ip IP" , "Remote host IP or hostname. FQDN for Kerberos auth (required)" ) { |val | options [ :ip ] = val }
101103 opts . on ( "-U" , "--url URL" , "Remote url endpoint (default /wsman)" ) { |val | options [ :url ] = val }
102- opts . on ( "-u" , "--user USER" , "Username (required)" ) { |val | options [ :user ] = val }
104+ opts . on ( "-u" , "--user USER" , "Username (required if not using kerberos )" ) { |val | options [ :user ] = val }
103105 opts . on ( "-p" , "--password PASS" , "Password" ) { |val | options [ :password ] = val }
104106 opts . on ( "-H" , "--hash HASH" , "NTHash" ) do |val |
105107 if !options [ :password ] . nil? and !val . nil?
@@ -163,6 +165,12 @@ def arguments()
163165 $pub_key = options [ :pub_key ]
164166 $priv_key = options [ :priv_key ]
165167 $realm = options [ :realm ]
168+ $service = options [ :service ]
169+ if !$realm. nil? then
170+ if $service. nil? then
171+ $service = $default_service
172+ end
173+ end
166174 end
167175
168176 # Print script header
@@ -200,7 +208,8 @@ def connection_initialization()
200208 user : "" ,
201209 password : "" ,
202210 transport : :kerberos ,
203- realm : $realm
211+ realm : $realm,
212+ service : $service
204213 )
205214 else
206215 $conn = WinRM ::Connection . new (
@@ -225,7 +234,7 @@ def docker_detection()
225234 def colorize ( text , color = "default" )
226235 colors = { "default" => "38" , "blue" => "34" , "red" => "31" , "yellow" => "1;33" , "magenta" => "35" }
227236 color_code = colors [ color ]
228- return "\033 [0;#{ color_code } #{ text } \033 [0m"
237+ return "\001 \ 033#{ color_code } \002 #{ text } \001 \ 033\002 "
229238 end
230239
231240 # Messsage printing
@@ -393,6 +402,10 @@ def main
393402 self . print_message ( "Password is not needed for Kerberos auth. Ticket will be used" , TYPE_WARNING )
394403 end
395404
405+ if $realm. nil? and !$service. nil? then
406+ self . print_message ( "Useless spn provided, only used for Kerberos auth" , TYPE_WARNING )
407+ end
408+
396409 if !$scripts_path. nil? then
397410 self . check_directories ( $scripts_path, "scripts" )
398411 functions = self . read_scripts ( $scripts_path)
@@ -412,7 +425,7 @@ def main
412425 when Readline . line_buffer =~ /help.*/i
413426 puts ( "#{ $LIST. join ( "\t " ) } )
414427 when Readline . line_buffer =~ /\[ .*/i
415- $LISTASSEM. grep ( /^#{ Regexp . escape ( str ) } ) unless str . nil?
428+ $LISTASSEM. grep ( /^#{ Regexp . escape ( str ) } ) unless str . nil?
416429 when Readline . line_buffer =~ /Invoke-Binary.*/i
417430 executables . grep ( /^#{ Regexp . escape ( str ) } ) unless str . nil?
418431 when Readline . line_buffer =~ /donutfile.*/i
@@ -590,6 +603,10 @@ def main
590603 STDERR . print ( stderr )
591604 end
592605 end
606+ rescue Errno ::EACCES => ex
607+ puts ( )
608+ self . print_message ( "An error of type #{ ex . class } #{ ex . message } , TYPE_ERROR )
609+ retry
593610 rescue Interrupt
594611 puts ( "\n \n " )
595612 self . print_message ( "Press \" y\" to exit, press any other key to continue" , TYPE_WARNING )
0 commit comments