7 comments on “MOF-tastic tricks or how to use MOF and powershell together

  1. Pingback: Meterpreter Post Module – Persistence via MOF/powershell | khr@sh#: echo $GREETING

  2. I’m not entirely sure if you’re even still on this forum, but when I try and use your persistence module, the screenshot function of metasploit no longer works. Has anyone else had this issue? Are there any fixes?

    • It might be due to the fact the shell returned from WMI is running as NT AUTHORITY\SYSTEM? Maybe there isn’t a desktop to screenshot? I think if you drop privs to another user it should work.

      • That’s actually exactly what I did a while ago and it worked, I had to migrate to a lower privs process and it worked fantasticly

  3. Pingback: Persistence – WMI Event Subscription | Penetration Testing Lab

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s