SprayWMI – PowerShell Injection Mass Spray Tool

Outsmart Malicious Hackers

SprayWMI is a method for mass spraying Unicorn PowerShell injection to CIDR notations. It’s an alternative to traditional, ‘noisy’ tools which leave something on the disk like PsExec, smbexec, winexe and so on.

SprayWMI - Unicorn PowerShell Injection Mass Spray Tool

These tools have worked really well, however, they are fairly noisy creating a service and touching disk which will trigger modern defense tools such as Bit9 and other tools that detect rogue binaries on systems. Even using something like the standard psexec module in Metasploit nowadays will cause Windows Security Essentials to flag the service exe that gets created.

Using WMI (Windows Management Instrumentation) gives us another path to execute code and commands on remote systems without touching disk or creating a new service. We also have the ability to use the actual password or the hash.

The initial WMI communications use TCP port 135 and afterwards a random port is negotiated. Since WMI and RPC services are often used for remote administration and administration tools, it is common to see these ports open and unfiltered on internal networks.

It’ll literally be raining shells after you fire this tool up.



It’s really fast, finishing a class C in around 4 seconds.

You can download SprayWMI here:


Or read more here.

Posted in: Exploits/Vulnerabilities, Hacking Tools, Windows Hacking

, , , , , , , , ,

Recent in Exploits/Vulnerabilities:
- US Voting Machines Hacked At DEF CON – Every One
- CrackMapExec – Active Directory Post-Exploitation Tool
- EvilAbigail – Automated Evil Maid Attack For Linux

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 238,784 views
- AJAX: Is your application secure enough? - 120,804 views
- eEye Launches 0-Day Exploit Tracker - 86,361 views

Comments are closed.