> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-commands/remote-commands-via-wmi.md).

# Remote Commands via WMI

**Windows Management Instrumentation** (WMI) is the infrastructure for management data and operations on Windows-based operating systems. Although you can write WMI scripts or applications to automate administrative tasks on remote computers, WMI also supplies management data to other parts of the operating system and products. For example, System Center Operations Manager or [Windows Remote Management](https://learn.microsoft.com/en-us/windows/win32/WinRM/portal).

WMI can create processes via the *Create* method from the *Win32\_Process* class. It communicates through [*Remote Procedure Calls*](https://learn.microsoft.com/en-us/windows/win32/rpc/rpc-start-page) (RPC) over port 135 for remote access and uses a higher-range port (19152-65535) for session data.

## Remote WMI-commands in PowerShell

You can execute WMI-commands in PowerShell with `Invoke-CimMethod`

### Create PSCredential

The first step is to create a new PSCredential

```powershell
$username = 'jen'
$password = 'Nexus123!'
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString
```

### Create CimSession

Next, we need to create a *Common Information Model* (CIM) via the *New-CimSession* cmdlet.

```powershell
$options = New-CimSessionOption -Protocol DCOM
$session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options 
```

### Invoke CimMethod

Finally, we invoke our command

```powershell
$command = 'calc'
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine=$command}
```

## Remote commands with wmic.exe

WMI command line tool (WMIC) is a scripting and automation utility that allows information retrivial and system administration via WMI, using some simple keywords (aliases). WMIC.exe is available on all Windows versions since Windows XP. Starting with Windows 10, version 21H1 and Windows Server 2022, WMIC is deprecated in favor of PowerShell. In Windows 11, version 24H2, WMIC is not installed by default. A Linux port of WMIC, `wmi-client`, is written in Python and is based on Samba4.

As default, only users in the `Administrators` or `Domain Admins` group can execute WMI-commands remotely.

To run a WMI alias-command remotely

```batch
C:\Users\fcastle>wmic computersystem get name
Name
THEPUNISHER

C:\Users\fcastle>wmic /node:192.168.140.129 /user:fcastle /password:"P@ssW0rd!" computersystem get name
Name
HYDRA-DC
```

To run any command remotely, calc.exe in this example

```batch
C:\Users\fcastle>wmic /node:"hydra-dc" /user:fcastle /password:"P@ssW0rd!" process call create "calc"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ProcessId = 2736;
        ReturnValue = 0;
};
```

### Protocols

WMIC creates processes via the *Create* method from the *Win32\_Process* class. It communicates through [*Remote Procedure Calls*](https://learn.microsoft.com/en-us/windows/win32/rpc/rpc-start-page) (RPC) over port 135 for remote access and uses a higher-range port (19152-65535) for session data.

## Resources

**Invoke-CimMethod** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-5.1>

Windows Management Instrumentation - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page>

Windows Management Instrumentation - Wikipedia: <https://en.wikipedia.org/wiki/Windows_Management_Instrumentation>

**wmic** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic>