# WmicExec
🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥 * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
## How Does it works Wmi allows to open process in hosts where you know username/(password/Hash). Then, Wmiexec uses wmi to execute each command that is asked to execute (this is why Wmicexec gives you semi-interactive shell). **dcomexec.py:** This script gives a semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints (ShellBrowserWindow DCOM object). Currently, it supports MMC20. Application, Shell Windows and Shell Browser Window objects. (from [here](https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/)) ## WMI Basics ### Namespace WMI is divided into a directory-style hierarchy, the \root container, with other directories under \root. These "directory paths" are called namespaces.\ List namespaces: ```bash #Get Root namespaces gwmi -namespace "root" -Class "__Namespace" | Select Name #List all namespaces (you may need administrator to list all of them) Get-WmiObject -Class "__Namespace" -Namespace "Root" -List -Recurse 2> $null | select __Namespace | sort __Namespace #List namespaces inside "root\cimv2" Get-WmiObject -Class "__Namespace" -Namespace "root\cimv2" -List -Recurse 2> $null | select __Namespace | sort __Namespace ``` List classes of a namespace with: ```bash gwmwi -List -Recurse #If no namespace is specified, by default is used: "root\cimv2" gwmi -Namespace "root/microsoft" -List -Recurse ``` ### **Classes** The WMI class name eg: win32\_process is a starting point for any WMI action. We always need to know a Class Name and the Namespace where it is located.\ List classes starting with `win32`: ```bash Get-WmiObject -Recurse -List -class win32* | more #If no namespace is specified, by default is used: "root\cimv2" gwmi -Namespace "root/microsoft" -List -Recurse -Class "MSFT_MpComput*" ``` Call a class: ```bash #When you don't specify a namespaces by default is "root/cimv2" Get-WmiObject -Class win32_share Get-WmiObject -Namespace "root/microsoft/windows/defender" -Class MSFT_MpComputerStatus ``` ### Methods WMI classes have one or more functions that can be executed. These functions are called methods. ```bash #Load a class using [wmiclass], leist methods and call one $c = [wmiclass]"win32_share" $c.methods #Find information about the class in https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-share $c.Create("c:\share\path","name",0,$null,"My Description") #If returned value is "0", then it was successfully executed ``` ```bash #List methods Get-WmiObject -Query 'Select * From Meta_Class WHERE __Class LIKE "win32%"' | Where-Object { $_.PSBase.Methods } | Select-Object Name, Methods #Call create method from win32_share class Invoke-WmiMethod -Class win32_share -Name Create -ArgumentList @($null, "Description", $null, "Name", $null, "c:\share\path",0) ``` ## WMI Enumeration ### Check WMI service This how you can check if WMI service is running: ```bash #Check if WMI service is running Get-Service Winmgmt Status Name DisplayName ------ ---- ----------- Running Winmgmt Windows Management Instrumentation #From CMD net start | findstr "Instrumentation" ``` ### System Information ```bash Get-WmiObject -ClassName win32_operatingsystem | select * | more ``` ### Process Information ```bash Get-WmiObject win32_process | Select Name, Processid ``` From an attacker's perspective, WMI can be very valuable in enumerating sensitive information about a system or the domain. ``` wmic computerystem list full /format:list wmic process list /format:list wmic ntdomain list /format:list wmic useraccount list /format:list wmic group list /format:list wmic sysaccount list /format:list ``` ```bash Get-WmiObject Win32_Processor -ComputerName 10.0.0.182 -Credential $cred ``` ## **Manual Remote WMI Querying** For example, here's a very stealthy way to discover local admins on a remote machine (note that domain is the computer name): ```bash wmic /node:ordws01 path win32_groupuser where (groupcomponent="win32_group.name=\"administrators\",domain=\"ORDWS01\"") ``` Another useful oneliner is to see who is logged on to a machine (for when you're hunting admins): ``` wmic /node:ordws01 path win32_loggedonuser get antecedent ``` `wmic` can even read nodes from a text file and execute the command on all of them. If you have a text file of workstations: ``` wmic /node:@workstations.txt path win32_loggedonuser get antecedent ``` **We'll remotely create a process over WMI to execute a Empire agent:** ```bash wmic /node:ordws01 /user:CSCOU\jarrieta path win32_process call create "**empire launcher string here**" ``` We see it executed successfully (ReturnValue = 0). And a second later our Empire listener catches it. Note the process ID is the same as WMI returned. All this information was extracted from here:
🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥 * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://breached.gitbook.io/dashboard/windows-hardening/lateral-movement/wmicexec.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.