{"action":"closed","number":1068,"pull_request":{"url":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068","id":181034886,"html_url":"https://github.com/EmpireProject/Empire/pull/1068","diff_url":"https://github.com/EmpireProject/Empire/pull/1068.diff","patch_url":"https://github.com/EmpireProject/Empire/pull/1068.patch","issue_url":"https://api.github.com/repos/EmpireProject/Empire/issues/1068","number":1068,"state":"closed","locked":false,"title":"Adds WMI Persistence Option","user":{"login":"jbooz1","id":19398243,"avatar_url":"https://avatars0.githubusercontent.com/u/19398243?v=4","gravatar_id":"","url":"https://api.github.com/users/jbooz1","html_url":"https://github.com/jbooz1","followers_url":"https://api.github.com/users/jbooz1/followers","following_url":"https://api.github.com/users/jbooz1/following{/other_user}","gists_url":"https://api.github.com/users/jbooz1/gists{/gist_id}","starred_url":"https://api.github.com/users/jbooz1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbooz1/subscriptions","organizations_url":"https://api.github.com/users/jbooz1/orgs","repos_url":"https://api.github.com/users/jbooz1/repos","events_url":"https://api.github.com/users/jbooz1/events{/privacy}","received_events_url":"https://api.github.com/users/jbooz1/received_events","type":"User","site_admin":false},"body":"The changes in this PR add a new option in the WMI Elevated Persistence Module. The concept of the new addition is 'Persistence at the attacker's request'. In essence, the persistence will be silent unless the attacker asks for it to call back.\r\n\r\nThe WMI Event Filter is looking for failed logon attempts from a specified user and will fire off the persistence as usual with this module. \r\n\r\nThis new addition requires the system to have local auditing to failed logins enabled. \r\n\r\nTo use the module the attacker should specify a username that they would like to use as the trigger, (username: redteam, for example).\r\nAfter deployment, every time the specified user fails to login, the WMI consumer will fire as system.\r\n(Failing to login to the system as the user redteam, will result in the Consumer firing off)\r\n\r\nI tested this on the base release version of Server08 R2 and the base release version of Windows 10.\r\n\r\nTo activate a failed login, I was able to use RDP, local logins, and smbclient to the C$ share to make the persistence fire off nicely","created_at":"2018-04-11T21:35:39Z","updated_at":"2018-04-17T21:01:48Z","closed_at":"2018-04-17T21:01:48Z","merged_at":null,"merge_commit_sha":"719c83726230e733642d55df202e391bc99c16bd","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068/commits","review_comments_url":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068/comments","review_comment_url":"https://api.github.com/repos/EmpireProject/Empire/pulls/comments{/number}","comments_url":"https://api.github.com/repos/EmpireProject/Empire/issues/1068/comments","statuses_url":"https://api.github.com/repos/EmpireProject/Empire/statuses/06423badf1066bce30ae83bfad30ee7bd9eea5c2","head":{"label":"jbooz1:master","ref":"master","sha":"06423badf1066bce30ae83bfad30ee7bd9eea5c2","user":{"login":"jbooz1","id":19398243,"avatar_url":"https://avatars0.githubusercontent.com/u/19398243?v=4","gravatar_id":"","url":"https://api.github.com/users/jbooz1","html_url":"https://github.com/jbooz1","followers_url":"https://api.github.com/users/jbooz1/followers","following_url":"https://api.github.com/users/jbooz1/following{/other_user}","gists_url":"https://api.github.com/users/jbooz1/gists{/gist_id}","starred_url":"https://api.github.com/users/jbooz1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbooz1/subscriptions","organizations_url":"https://api.github.com/users/jbooz1/orgs","repos_url":"https://api.github.com/users/jbooz1/repos","events_url":"https://api.github.com/users/jbooz1/events{/privacy}","received_events_url":"https://api.github.com/users/jbooz1/received_events","type":"User","site_admin":false},"repo":{"id":125068309,"name":"Empire","full_name":"jbooz1/Empire","owner":{"login":"jbooz1","id":19398243,"avatar_url":"https://avatars0.githubusercontent.com/u/19398243?v=4","gravatar_id":"","url":"https://api.github.com/users/jbooz1","html_url":"https://github.com/jbooz1","followers_url":"https://api.github.com/users/jbooz1/followers","following_url":"https://api.github.com/users/jbooz1/following{/other_user}","gists_url":"https://api.github.com/users/jbooz1/gists{/gist_id}","starred_url":"https://api.github.com/users/jbooz1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbooz1/subscriptions","organizations_url":"https://api.github.com/users/jbooz1/orgs","repos_url":"https://api.github.com/users/jbooz1/repos","events_url":"https://api.github.com/users/jbooz1/events{/privacy}","received_events_url":"https://api.github.com/users/jbooz1/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jbooz1/Empire","description":"Empire is a PowerShell and Python post-exploitation agent.","fork":true,"url":"https://api.github.com/repos/jbooz1/Empire","forks_url":"https://api.github.com/repos/jbooz1/Empire/forks","keys_url":"https://api.github.com/repos/jbooz1/Empire/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jbooz1/Empire/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jbooz1/Empire/teams","hooks_url":"https://api.github.com/repos/jbooz1/Empire/hooks","issue_events_url":"https://api.github.com/repos/jbooz1/Empire/issues/events{/number}","events_url":"https://api.github.com/repos/jbooz1/Empire/events","assignees_url":"https://api.github.com/repos/jbooz1/Empire/assignees{/user}","branches_url":"https://api.github.com/repos/jbooz1/Empire/branches{/branch}","tags_url":"https://api.github.com/repos/jbooz1/Empire/tags","blobs_url":"https://api.github.com/repos/jbooz1/Empire/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jbooz1/Empire/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jbooz1/Empire/git/refs{/sha}","trees_url":"https://api.github.com/repos/jbooz1/Empire/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jbooz1/Empire/statuses/{sha}","languages_url":"https://api.github.com/repos/jbooz1/Empire/languages","stargazers_url":"https://api.github.com/repos/jbooz1/Empire/stargazers","contributors_url":"https://api.github.com/repos/jbooz1/Empire/contributors","subscribers_url":"https://api.github.com/repos/jbooz1/Empire/subscribers","subscription_url":"https://api.github.com/repos/jbooz1/Empire/subscription","commits_url":"https://api.github.com/repos/jbooz1/Empire/commits{/sha}","git_commits_url":"https://api.github.com/repos/jbooz1/Empire/git/commits{/sha}","comments_url":"https://api.github.com/repos/jbooz1/Empire/comments{/number}","issue_comment_url":"https://api.github.com/repos/jbooz1/Empire/issues/comments{/number}","contents_url":"https://api.github.com/repos/jbooz1/Empire/contents/{+path}","compare_url":"https://api.github.com/repos/jbooz1/Empire/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jbooz1/Empire/merges","archive_url":"https://api.github.com/repos/jbooz1/Empire/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jbooz1/Empire/downloads","issues_url":"https://api.github.com/repos/jbooz1/Empire/issues{/number}","pulls_url":"https://api.github.com/repos/jbooz1/Empire/pulls{/number}","milestones_url":"https://api.github.com/repos/jbooz1/Empire/milestones{/number}","notifications_url":"https://api.github.com/repos/jbooz1/Empire/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jbooz1/Empire/labels{/name}","releases_url":"https://api.github.com/repos/jbooz1/Empire/releases{/id}","deployments_url":"https://api.github.com/repos/jbooz1/Empire/deployments","created_at":"2018-03-13T14:54:38Z","updated_at":"2018-03-29T02:39:58Z","pushed_at":"2018-03-29T02:39:57Z","git_url":"git://github.com/jbooz1/Empire.git","ssh_url":"git@github.com:jbooz1/Empire.git","clone_url":"https://github.com/jbooz1/Empire.git","svn_url":"https://github.com/jbooz1/Empire","homepage":"http://www.powershellempire.com/","size":20329,"stargazers_count":0,"watchers_count":0,"language":"PowerShell","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"EmpireProject:master","ref":"master","sha":"efba9bc3680aa913f514ae15a8399937b7a2ff79","user":{"login":"EmpireProject","id":25492515,"avatar_url":"https://avatars3.githubusercontent.com/u/25492515?v=4","gravatar_id":"","url":"https://api.github.com/users/EmpireProject","html_url":"https://github.com/EmpireProject","followers_url":"https://api.github.com/users/EmpireProject/followers","following_url":"https://api.github.com/users/EmpireProject/following{/other_user}","gists_url":"https://api.github.com/users/EmpireProject/gists{/gist_id}","starred_url":"https://api.github.com/users/EmpireProject/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EmpireProject/subscriptions","organizations_url":"https://api.github.com/users/EmpireProject/orgs","repos_url":"https://api.github.com/users/EmpireProject/repos","events_url":"https://api.github.com/users/EmpireProject/events{/privacy}","received_events_url":"https://api.github.com/users/EmpireProject/received_events","type":"Organization","site_admin":false},"repo":{"id":40262072,"name":"Empire","full_name":"EmpireProject/Empire","owner":{"login":"EmpireProject","id":25492515,"avatar_url":"https://avatars3.githubusercontent.com/u/25492515?v=4","gravatar_id":"","url":"https://api.github.com/users/EmpireProject","html_url":"https://github.com/EmpireProject","followers_url":"https://api.github.com/users/EmpireProject/followers","following_url":"https://api.github.com/users/EmpireProject/following{/other_user}","gists_url":"https://api.github.com/users/EmpireProject/gists{/gist_id}","starred_url":"https://api.github.com/users/EmpireProject/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EmpireProject/subscriptions","organizations_url":"https://api.github.com/users/EmpireProject/orgs","repos_url":"https://api.github.com/users/EmpireProject/repos","events_url":"https://api.github.com/users/EmpireProject/events{/privacy}","received_events_url":"https://api.github.com/users/EmpireProject/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/EmpireProject/Empire","description":"Empire is a PowerShell and Python post-exploitation agent.","fork":false,"url":"https://api.github.com/repos/EmpireProject/Empire","forks_url":"https://api.github.com/repos/EmpireProject/Empire/forks","keys_url":"https://api.github.com/repos/EmpireProject/Empire/keys{/key_id}","collaborators_url":"https://api.github.com/repos/EmpireProject/Empire/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/EmpireProject/Empire/teams","hooks_url":"https://api.github.com/repos/EmpireProject/Empire/hooks","issue_events_url":"https://api.github.com/repos/EmpireProject/Empire/issues/events{/number}","events_url":"https://api.github.com/repos/EmpireProject/Empire/events","assignees_url":"https://api.github.com/repos/EmpireProject/Empire/assignees{/user}","branches_url":"https://api.github.com/repos/EmpireProject/Empire/branches{/branch}","tags_url":"https://api.github.com/repos/EmpireProject/Empire/tags","blobs_url":"https://api.github.com/repos/EmpireProject/Empire/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/EmpireProject/Empire/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/EmpireProject/Empire/git/refs{/sha}","trees_url":"https://api.github.com/repos/EmpireProject/Empire/git/trees{/sha}","statuses_url":"https://api.github.com/repos/EmpireProject/Empire/statuses/{sha}","languages_url":"https://api.github.com/repos/EmpireProject/Empire/languages","stargazers_url":"https://api.github.com/repos/EmpireProject/Empire/stargazers","contributors_url":"https://api.github.com/repos/EmpireProject/Empire/contributors","subscribers_url":"https://api.github.com/repos/EmpireProject/Empire/subscribers","subscription_url":"https://api.github.com/repos/EmpireProject/Empire/subscription","commits_url":"https://api.github.com/repos/EmpireProject/Empire/commits{/sha}","git_commits_url":"https://api.github.com/repos/EmpireProject/Empire/git/commits{/sha}","comments_url":"https://api.github.com/repos/EmpireProject/Empire/comments{/number}","issue_comment_url":"https://api.github.com/repos/EmpireProject/Empire/issues/comments{/number}","contents_url":"https://api.github.com/repos/EmpireProject/Empire/contents/{+path}","compare_url":"https://api.github.com/repos/EmpireProject/Empire/compare/{base}...{head}","merges_url":"https://api.github.com/repos/EmpireProject/Empire/merges","archive_url":"https://api.github.com/repos/EmpireProject/Empire/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/EmpireProject/Empire/downloads","issues_url":"https://api.github.com/repos/EmpireProject/Empire/issues{/number}","pulls_url":"https://api.github.com/repos/EmpireProject/Empire/pulls{/number}","milestones_url":"https://api.github.com/repos/EmpireProject/Empire/milestones{/number}","notifications_url":"https://api.github.com/repos/EmpireProject/Empire/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/EmpireProject/Empire/labels{/name}","releases_url":"https://api.github.com/repos/EmpireProject/Empire/releases{/id}","deployments_url":"https://api.github.com/repos/EmpireProject/Empire/deployments","created_at":"2015-08-05T18:25:57Z","updated_at":"2018-04-17T16:44:45Z","pushed_at":"2018-04-17T02:42:45Z","git_url":"git://github.com/EmpireProject/Empire.git","ssh_url":"git@github.com:EmpireProject/Empire.git","clone_url":"https://github.com/EmpireProject/Empire.git","svn_url":"https://github.com/EmpireProject/Empire","homepage":"http://www.powershellempire.com/","size":20572,"stargazers_count":2971,"watchers_count":2971,"language":"PowerShell","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1022,"mirror_url":null,"archived":false,"open_issues_count":22,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause"},"forks":1022,"open_issues":22,"watchers":2971,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068"},"html":{"href":"https://github.com/EmpireProject/Empire/pull/1068"},"issue":{"href":"https://api.github.com/repos/EmpireProject/Empire/issues/1068"},"comments":{"href":"https://api.github.com/repos/EmpireProject/Empire/issues/1068/comments"},"review_comments":{"href":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068/comments"},"review_comment":{"href":"https://api.github.com/repos/EmpireProject/Empire/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/EmpireProject/Empire/pulls/1068/commits"},"statuses":{"href":"https://api.github.com/repos/EmpireProject/Empire/statuses/06423badf1066bce30ae83bfad30ee7bd9eea5c2"}},"author_association":"NONE","merged":false,"mergeable":true,"rebaseable":true,"mergeable_state":"clean","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":3,"additions":102,"deletions":79,"changed_files":1}}
{"actor":{"display_login":"jbooz1"}}