> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/docs/windows-documentation/wmic.md).

# wmic

Wmic is the WMI command-line console. It includes WQL (WMI Query Language) which is a subset of SQL.

{% hint style="info" %}
Important

The WMI command-line (WMIC) utility is deprecated as of Windows 10, version 21H1, and as of the 21H1 semi-annual channel release of Windows Server. This utility is superseded by Windows PowerShell for WMI (see [Chapter 7 - Working with WMI](https://learn.microsoft.com/en-us/powershell/scripting/learn/ps101/07-working-with-wmi)). This deprecation applies only to the WMI command-line (WMIC) utility; Windows Management Instrumentation (WMI) itself is not affected. Also see [Windows 10 features we're no longer developing](https://learn.microsoft.com/en-us/windows/deployment/planning/windows-10-deprecated-features).
{% endhint %}

## General Help

```batch
wmic /?     # Show help with all commands and aliases
wmic -?     # Show help with all commands and aliases
```

## Aliases

### List Properties

```batch
wmic <alias> list brief    # Show a brief listing
wmic <alias>               # Show a slightly more detailed list
wmic <alias> list          # Same as above, i.e. the default command is list
wmic <alias> list full     # Show a full listing
wmic <alias> list -?       # Show all possible list types
```

### Get Specific Properties

```batch
wmic <alias> get prop1,prop2,prop3    # Show the selected three properties
```

Notes:

* The properties are not case-sensitive
* The properties will be shown alphabetically (and not in the typed order)

### Output formats

As a standard a `csv` (comma separated values) format is used. The available formats are:

* csv - comma separated text
* htable - HTML Table
* list - ASCII list
* xml - XML

To change format, add `/format:xxx` to your command.

## WQL Syntax

Logical expressions such as `AND` and `OR` are supported:

```batch
C:\>wmic process where (name="cmd.exe" or name="calc.exe") list brief
HandleCount  Name     Priority  ProcessId  ThreadCount  WorkingSetSize
93           cmd.exe  8         4752       1            5148672
81           cmd.exe  8         5212       1            4853760
```

Also, we can match substrings in a where clause with the use of `LIKE` and `%`, as in:

```batch
C:\>wmic process where (executablepath like "%system32%") list brief
HandleCount  Name                       Priority  ProcessId  ThreadCount  WorkingSetSize
300          svchost.exe                8         4820       3            18649088
526          sihost.exe                 8         204        8            28762112
388          svchost.exe                8         4816       2            32006144
261          taskhostw.exe              8         5220       6            15777792
335          svchost.exe                8         6664       12           23674880
<---snip--->
```

We can also use `NOT` as in:

```batch
C:\>wmic PROCESS WHERE "NOT ExecutablePath LIKE '%Windows%'" GET ExecutablePath
ExecutablePath
C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
```

## Resources

Windows Management Instrumentation - Wikipedia: <https://en.wikipedia.org/wiki/Windows_Management_Instrumentation>

wmic - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic>

WQL (SQL for WMI) - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/wmisdk/wql-sql-for-wmi>

WQL - Wikipedia: <https://en.wikipedia.org/wiki/WQL>