You are currently viewing WMEye


It is a post-exploitation tool that uses the WMI Event Filter and MSBuild execution to allow for lateral movement.

Currently employed:

  1. Creates a Remote WMI Class 2. Adds Shellcode as a property value to the previously built Fake WMI Class 3. Creates a WMI Event Filter that fires when the powershell.exe process is started
  2. It uses LogFileEventConsumer to upload MSBuild Payload into a remote system when an event is triggered (A WMI Consumer type to write Log Files)

Finally, run Win32 Process. Create a script to contact MSBuild from afar.

Disclaimer: The intended use for the tool is strictly educational and should not be used for any other purpose

Download Link:

Leave a Reply