RDP and WMI Example

[Cyb3r-Monk]

I checked the sample timeline configs but couldn't find any detail about credentialsfile and credkey. What should be the format of credentials file? Could you provide a working example?

[rbreesems]

Here is an example

##passwords must be base64 encoded, ie:  "hello" would be "aGVsbG8="
##Here is a link to an online base64 encoder:  https://codebeautify.org/base64-encode
# the credential file is not meant to be 'secure', the base64 encoding is so that you don't have to escape special characters.
# the version number is there in case a different format is introduced later (like a 'secure' format)
## Credential files can have any number of entries, but each entry must have a unique key, typically the IP 
## or a combination of IP+Username if more than one credential per host
# The 'credkey' is the unique key for one of the entries

##SSH/SFTP/RDP Credential file example
{
   "Version": "1.0",
   "Data": {
   "someUniqueKeyTypicallyIP": {"username":"A_USER_NAME","password":"A_PASSWORD_BASE64ENCODED"},
   "someUniqueKey2TypicallyIP": {"username":"A_USER_NAME2","password":"A_PASSWORD2_BASE64ENCODED"},
   }
}




##WMI cred file, same format except adds a 'domain' entry, the WMI handler assumes the  login is for a domain 
{
   "Version": "1.0",
   "Data": {
   "someUniqueKeyTypicallyIP": {"domain":"A_DOMAIN_NAME","username":"A_USER_NAME","password":"A_PASSWORD_BASE64ENCODED"},
   "someUniqueKey2TypicallyIP": {"domain":"A_DOMAIN_NAME2","username":"A_USER_NAME2","password":"A_PASSWORD2_BASE64ENCODED"},
   }
}

[Cyb3r-Monk]

Thanks a lot, Bob!